Use reverse() and {% url %} instead of hardcoded URL paths

[mlissner]

Fixes

This fixes a missing slash bug in subscription diff email links and eliminates all hardcoded URL paths across Python and JavaScript.

Summary

Replace hardcoded URL construction with Django's reverse() in Python and {% url %} template tags passed to JavaScript via JSON config blocks.

Python backend (3 files):

• subscriptions/tasks.py — email notification URLs (page link + diff link) now use reverse(); fixes the original missing-slash bug
• pages/views.py — page history diff_base now uses reverse("page_diff") with dummy values (matches existing directory pattern)
• lib/views.py — llms.txt entry URLs now use reverse("page_raw_markdown")

JavaScript + templates (9 files):

• markdown-editor.js — 7 hardcoded API/page URLs replaced with config.urls.*
• page-form.js — 4 hardcoded API URLs replaced with config.urls.*
• username-autocomplete.js — 1 hardcoded API URL replaced with config-driven value
• 6 templates updated to pass URLs via <script type="application/json"> config blocks using {% url %} tags

Documentation:

• CLAUDE.md rule 3 expanded to cover JavaScript URL handling

Deployment

This PR should:

• skip-deploy (skips everything below)
  • skip-web-deploy
  • skip-daemon-deploy

🤖 Generated with Claude Code

[claude]

LGTM — mechanical URL hardcoding removal with a real bug fix included.

Extended reasoning...

Overview

This PR touches 13 files across Python backend (subscriptions, pages, lib) and JS/template layers. All changes follow a single mechanical pattern: replace hardcoded URL strings with Django reverse() in Python and {% url %} tags passed via JSON config blocks to JavaScript.

Security risks

No security concerns — the change moves away from hardcoded strings toward Django’s URL resolution, which is strictly safer. The JSON config block pattern is standard for safely passing server-side data to client-side JS without inline script injection.

Level of scrutiny

Low. The changes are repetitive and mechanical. The only non-trivial logic is the diff_base construction in pages/views.py, which uses reverse("page_diff", kwargs={..."v1": 0, "v2": 0}).rsplit("0/0/", 1)[0] to strip the dummy values — slightly clever but clearly correct given the URL structure. The subscription task bug fix (missing slash between get_absolute_url() and diff/) is also straightforward.

Other factors

No bugs reported by the automated system. All URL names referenced (resolve_path, page_diff, page_raw_markdown, presign_upload, confirm_upload, file_upload, page_preview, user_search, page_search, dir_inherit_meta, dir_search, check_page_perms) appear to be in active use across the codebase. The CLAUDE.md documentation update correctly codifies the pattern for future contributors.