fix: address Copilot PR review suggestions

[LLOKAI]

• words.py: replace f-string SQL interpolation with CASE expression to prevent SQL injection pattern
• audio.py: add path traversal protection with resolve() + parent check
• topic.js: use textContent instead of innerHTML for translation display
• app.js: use createElement/textContent instead of innerHTML for category cards
• SCORING.md: fix line number references and remove approximate line refs

[Copilot]

Pull request overview

This PR addresses prior security and correctness review feedback across the frontend and backend by removing unsafe HTML/SQL patterns, adding path traversal protection, and correcting scoring documentation references.

Changes:

• Frontend: replace innerHTML usage with safer textContent/DOM node construction for translations and category cards.
• Backend: remove dynamic SQL column interpolation by selecting translations via a parameterized CASE expression.
• Backend: harden audio file serving against path traversal via resolve() + base-directory containment checks, and update SCORING.md references.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
topic.js	Switch translation display from innerHTML to textContent to avoid HTML injection.
app.js	Render category cards with DOM APIs instead of innerHTML to avoid HTML injection patterns.
backend/app/routes/words.py	Parameterize language selection via SQL CASE instead of interpolating a column name.
backend/app/routes/audio.py	Add resolved-path containment checks to prevent path traversal when streaming audio.
backend/SCORING.md	Adjust line references and remove approximate line numbers in tuning reference sections.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This reference points to feature_comparator.py, but the actual module in this repo appears to be backend/app/services/feature_comparator.py (consistent with earlier sections of this doc). Update the path here to avoid sending readers to a non-existent file name.

Suggested change

	**File:** `feature_comparator.py`, lines 13–19
	**File:** `backend/app/services/feature_comparator.py`, lines 13–19