* fix: resolve plugin class loading reliability issues
* fix: address CodeRabbit XSS and accessibility findings from PR #18
- admin/js/admin-scripts.js: replace HTML string interpolation in showNotice
with DOM API construction and .text() to prevent XSS; whitelist type values
- admin/js/update-source-selector.js: replace .html(message) with .text(message)
in showMessage to prevent XSS from AJAX response content
- admin/templates/modal.php: add role=dialog, aria-modal=true, aria-labelledby
for screen reader semantics; replace <span> close control with <button> for
keyboard operability and proper ARIA role
