#134 Inject hygiene sweep: small verified issues from the audit

[Anonymous]

Originally created by: kristofferR

Small, verified, individually low-priority issues worth batching:

• media-viewer.ts exit() strips pre-existing inline styles with greedy regexes (transform, max-width/height), breaking Facebook's own collage/crop styling until re-render; save/restore the original cssText like fullscreen.ts does.
• system-emoji.ts glyph spans orphan when React reconciles away the sprite but keeps the parent — a stale emoji keeps rendering; sweep [GLYPH_ATTR] spans whose sprite is gone.
• messenger.css's global overflow: hidden on <html> applies to checkpoint/consent interstitials too; tall auth pages can have unreachable below-the-fold content. Scope it to the logged-in app.
• lib/privacy.ts: sender names containing digits (or >40 chars) are never blurred in second-line previews under Hide Names — the timestamp guard rejects "Anna 2" too. Allow digits when not time-shaped.
• auto-refresh.ts gates only on document.hasFocus(), so a visible-but-unfocused window (second monitor) gets yanked through a reload mid-read; add a visibility check to the periodic path.

[Anonymous]

Originally posted by: kristofferR

Fixed in [#137]: the small verified inject-hygiene issues surfaced by the audit were swept up.

[Anonymous]

Ticket changed by: kristofferR

• status: open --> closed