fix: sanitize export IDs for valid CSS selectors

Export IDs contain special characters (colons and slashes from DIDs)
that are invalid in CSS selectors. This fix:

1. Added sanitizeID() template function and handler helper
2. Converts IDs like "did:plc:xxx/2025-11-02_18-24-04" to "did-plc-xxx-2025-11-02_18-24-04"
3. Uses sanitized ID for tr id attribute
4. Uses sanitized ID in hx-target="#export-{sanitizedID}"
5. Keeps original ID in data-export-id attribute for backend operations

This allows HTMX to properly target and delete table rows without
CSS selector syntax errors.

Fixes: SyntaxError: '#export-did:plc:...' is not a valid selector

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <[e-mail]>

internal/web/handlers/export.go

···
 	"log"
 	"net/http"
 	"os"
+	"strings"
 	"sync"
 	"time"
 
···
 	})
 }
 
+// sanitizeID converts an export ID to a valid CSS selector ID
+// by replacing special characters with hyphens
+func sanitizeID(id string) string {
+	replacer := strings.NewReplacer(
+		":", "-",
+		"/", "-",
+		" ", "-",
+	)
+	sanitized := replacer.Replace(id)
+	// Remove any remaining non-alphanumeric characters except hyphens
+	var result strings.Builder
+	for _, ch := range sanitized {
+		if (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || ch == '-' || ch == '_' {
+			result.WriteRune(ch)
+		}
+	}
+	return result.String()
+}
+
 // ExportRow returns a single export as an HTML table row fragment for HTMX
 func (h *Handlers) ExportRow(w http.ResponseWriter, r *http.Request) {
 	session, ok := auth.GetSessionFromContext(r.Context())
···
 
 	// Return HTML table row
 	w.Header().Set("Content-Type", "text/html")
-	fmt.Fprintf(w, `<tr id="export-%s">
+	sanitizedID := sanitizeID(exportRecord.ID)
+	fmt.Fprintf(w, `<tr id="export-%s" data-export-id="%s">
 		<td>%s</td>
 		<td>%s</td>
 		<td>%s</td>
···
 							style="margin: 0;"
 							hx-delete="/export/delete/%s"
 							hx-confirm="Are you sure you want to delete this export? This action cannot be undone."
-							hx-target="closest tr"
-							hx-swap="delete"
+							hx-target="#export-%s"
+							hx-swap="outerHTML"
 							hx-headers='{"X-CSRF-Token": "%s"}'>
 						Delete
 					</button>
···
 			</div>
 		</td>
 	</tr>`,
-		exportRecord.ID, // For tr id="export-%s"
+		sanitizedID,     // For tr id="export-%s"
+		exportRecord.ID, // For tr data-export-id="%s" (original ID)
 		exportRecord.CreatedAt.Format("2006-01-02 15:04"),
 		exportRecord.Format,
 		exportRecord.DateRangeString(),
···
 		exportRecord.ID, // For download link href
 		exportRecord.ID, // For download button data-export-id
 		exportRecord.ID, // For delete button hx-delete
+		sanitizedID,     // For delete button hx-target="#export-%s"
 		csrfToken,       // For delete button X-CSRF-Token
 		exportRecord.ID, // For checkbox data-export-id
 	)

internal/web/handlers/template.go

···
 			}
 			return false
 		},
+		"sanitizeID": func(id string) string {
+			// Replace special characters with hyphens to create valid CSS selectors
+			// Replaces : / and any other non-alphanumeric characters
+			replacer := strings.NewReplacer(
+				":", "-",
+				"/", "-",
+				" ", "-",
+			)
+			sanitized := replacer.Replace(id)
+			// Remove any remaining non-alphanumeric characters except hyphens
+			var result strings.Builder
+			for _, ch := range sanitized {
+				if (ch >= 'a' && ch <= 'z') || (ch >= 'A' && ch <= 'Z') || (ch >= '0' && ch <= '9') || ch == '-' || ch == '_' {
+					result.WriteRune(ch)
+				}
+			}
+			return result.String()
+		},
 	}
 }
 

internal/web/templates/pages/export.html

···
                 </thead>
                 <tbody id="exports-tbody">
                     {{range .Exports}}
-                    <tr id="export-{{.ID}}">
+                    <tr id="export-{{sanitizeID .ID}}" data-export-id="{{.ID}}">
                         <td>{{.CreatedAt.Format "2006-01-02 15:04"}}</td>
                         <td>{{.Format}}</td>
                         <td>{{.DateRangeString}}</td>
···
                                             style="margin: 0;"
                                             hx-delete="/export/delete/{{.ID}}"
                                             hx-confirm="Are you sure you want to delete this export? This action cannot be undone."
-                                            hx-target="closest tr"
+                                            hx-target="#export-{{sanitizeID .ID}}"
                                             hx-swap="outerHTML"
                                             hx-headers='{"X-CSRF-Token": "{{$.CSRFToken}}"}'>
                                         Delete