fix(pathanalyzer): show the hop token as code, not escaped markup

The map popups for a hop and for an ambiguous candidate passed the
<code> wrapper as a tHtml() param. tHtml() escapes params by design and
trusts only the catalog string, so the popup rendered the literal text
"<code>47</code>". Move the wrapper into the en/pl catalog values and
pass the bare token, which keeps the token itself escaped.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

app/static/js/path-analyzer.js

@@ -759,7 +759,7 @@ function paDrawEcho(msg, echo, primary, seen, altColor) {
         if (contact) {
             if (primary) {
                 L.marker([contact.adv_lat, contact.adv_lon], { icon: paHopIcon(i + 1) })
-                    .bindPopup(`<strong>${contact.name}</strong><br>${tHtml('pa.map.hop', { n: i + 1, token: `<code>${tok}</code>` })}`)
+                    .bindPopup(`<strong>${contact.name}</strong><br>${tHtml('pa.map.hop', { n: i + 1, token: tok })}`)
                     .bindTooltip(contact.name, { permanent: true, direction: 'right', offset: [13, 0], className: 'pa-hop-label' })
                     .addTo(layer);
             }
@@ -771,7 +771,7 @@ function paDrawEcho(msg, echo, primary, seen, altColor) {
                 candidates.forEach(c => {
                     L.circleMarker([c.adv_lat, c.adv_lon], {
                         radius: 6, color: '#d39e00', weight: 2, fillOpacity: 0.5, dashArray: '3'
-                    }).bindPopup(`<strong>${c.name}</strong><br>${tHtml('pa.map.candidate', { n: i + 1, token: `<code>${tok}</code>` })}`).addTo(layer);
+                    }).bindPopup(`<strong>${c.name}</strong><br>${tHtml('pa.map.candidate', { n: i + 1, token: tok })}`).addTo(layer);
                 });
             }
             gapPending = true;

app/translations/en.json

@@ -672,10 +672,10 @@
   },
   "pa.loading": "Loading messages…",
   "pa.map.alt_path": "Alternative path",
-  "pa.map.candidate": "Candidate for hop {n}: {token}",
+  "pa.map.candidate": "Candidate for hop {n}: <code>{token}</code>",
   "pa.map.clear_title": "Clear drawn path",
   "pa.map.hint": "Click a message, then an echo to draw its path.",
-  "pa.map.hop": "Hop {n}: {token}",
+  "pa.map.hop": "Hop {n}: <code>{token}</code>",
   "pa.map.no_routed": "No messages with routed echoes match the current filters.",
   "pa.map.origin": "Origin (sender)",
   "pa.me": "Me",

app/translations/pl.json

@@ -716,10 +716,10 @@
   },
   "pa.loading": "Wczytywanie wiadomości…",
   "pa.map.alt_path": "Ścieżka alternatywna",
-  "pa.map.candidate": "Kandydat na hop {n}: {token}",
+  "pa.map.candidate": "Kandydat na hop {n}: <code>{token}</code>",
   "pa.map.clear_title": "Wyczyść narysowaną ścieżkę",
   "pa.map.hint": "Kliknij wiadomość, a potem echo, aby narysować jej ścieżkę.",
-  "pa.map.hop": "Hop {n}: {token}",
+  "pa.map.hop": "Hop {n}: <code>{token}</code>",
   "pa.map.no_routed": "Żadna wiadomość z echami z trasą nie pasuje do bieżących filtrów.",
   "pa.map.origin": "Źródło (nadawca)",
   "pa.me": "Ja",