feat(wizard): review fixes, 6-step flow, a11y, security and deps

[Thorfinson]

Summary

This PR applies the fixes from a code, UI and accessibility review of feature/wizard-redesign, plus some cleanup and dependency updates. It also fixes several bugs found along the way. Among them are two security issues and wizard options that previously had no effect.

⚠️ Behaviour changes to be aware of

• Six steps instead of five: Step 4 is split into Projection and Glyphs & Color, and Review is now Step 6. Saved wizard state in localStorage is migrated automatically (format version 2).

• Undo/Redo moved to the title bar, next to Start over. Start over now uses the restart_alt icon and a native confirmation dialog.

• Accent colour is now #00737d instead of #00bcd4 for text, focus rings and primary buttons, to meet WCAG contrast. No text is smaller than 11px.

• druidjs 0.7.3 → 0.9.0

  • Projections are about 2.7× faster, and embeddings change (corrected UMAP and SAMMON).
  • The licence is now LGPL-3.0-or-later. The site now ships licenses/ (LGPL and GPL text plus a notice) and 3rdpartylicenses.txt.
  • TriMap's "Weight Adjustment" slider was removed, because the parameter no longer exists in 0.9.
  • LLE is hidden because of an upstream bug in 0.9. To bring it back, remove it from HIDDEN_PROJECTION_METHODS.

• Pipeline options that did nothing now take effect:

  • "Remove rows" for missing values
  • outlier Remove/Cap
  • Normalize/Standardize encodings
  • "Remove duplicates" for files without an ID column
  • UMAP min_dist 0

  Processed datasets can therefore differ from before.

Security

• Python code injection: CSV column headers and file names were pasted into Python source in the Pyodide worker. They are now passed only as data (workers/pyodide-calls.ts). Unsafe file names are rejected.
• Stored XSS in the dashboard tooltip: CSV values, labels and IDs were inserted as HTML through bypassSecurityTrustHtml. They are now rendered through the template.

Fixes

• Undo/redo: every user action is exactly one undo entry. This fixes:
  • Step 3 filling the history just by opening it
  • bulk actions creating several entries
  • projection changes bypassing history and storage
  • toast "Undo" reverting the wrong action
  • undo firing during processing
• Missing values:
  • tooltips show missing instead of 0
  • missing numbers and dates no longer distort the scaling
  • boolean labels were swapped when the first row was True
  • Step 3 dropdowns showed "None"/"Keep" while another setting was active
• Colour scale is now saved.
• Runtime:
  • closing the wizard mid-animation, double start in Step 6, the shift-click range after filtering
  • worker requests now carry request IDs
  • Pyodide file cleanup keeps the files the undo history still needs
• CLI (tools/process.py):
  • labels no longer shift after one-hot columns
  • underscore categories are handled
  • Breitengrad/Längengrad (latitude/longitude) were swapped

UX and accessibility

• The wizard is a modal dialog: focus trap, Escape to close, focus returns to the opener. Focus and a screen-reader announcement follow every step change.
• File upload works by keyboard, all controls are labelled, and glyph features can be reordered by keyboard. There are live regions for status and toasts.
• Step 3 shows the consequences of each setting using the data's own numbers. The stepper summarises your choices. Step 1 offers sample data (Wine Quality, CC BY 4.0).
• Background projections can be cancelled or retried one at a time, without Start over.
• Design tokens: type scale, spacing, z-index and severity colours. Steps 3–5 stack below 1024px.

Cleanup and infrastructure

• Angular 21.2.24 (security patches), three 0.186, zone.js 0.16, Pyodide 0.29.5.
• gsap was replaced by the Web Animations API, and unused packages were removed. npm audit shows 0 findings.
• Tests: Karma/Jasmine were replaced by Vitest in browser mode (headless Chromium via Playwright).
• CI: Node 24 (.nvmrc); lint, tests and build run before deploy.
• Bundle: the wizard is lazy-loaded with @defer; initial bundle 1.47 MB → 1.11 MB. Only the filled icon font ships now.
• Code size:
  • projection-preview 1,397 → 186 lines (the drawing engine is now separate)
  • projection worker ~420 → 62 lines
• Removed dead code: the in-browser CSV path (processor.py); dataset_common.py moved to tools/.
• Docs: README.md, docs/wizard.md (new developer notes) and the ROADMAP.md section "Review-Runde".

Where to start reviewing

1. workers/pyodide-calls.ts, canvas/tooltip/: the security fixes
2. services/preprocessing.service.ts, services/history-diff.ts, services/wizard-storage.ts: undo and storage
3. src/assets/preprocessing_processor_config.py: pipeline order and options (processing order is in the file header)
4. shared/constants/step-info.ts and the new step folders: the step split

Test plan

• npm run test:ci: 743 passed
• python -m pytest tools/tests: 232 passed, each run with default pandas and with pandas-3 behaviour
• tsc for app, spec and worker; ng lint 0 errors; ng build (production) within budgets
• Pyodide 0.29.5 end-to-end (Node): injection attempts, pipeline options, missing values
• All 11 DruidJS methods in a real worker in Chromium, Firefox and WebKit
• First CI run on GitHub, in particular the Playwright install step and the deploy job
• Manual run of the wizard with the sample data through all 6 steps, including undo/redo, cancelling a background projection, and reloading mid-wizard
• Visual check of the dashboard after the three.js 0.186 upgrade
• Check that licenses/ and 3rdpartylicenses.txt appear on the deployed site

Known issues and follow-ups

• LLE stays hidden until druidjs fixes it (bug report text is ready).
• With scaling "None", missing values land at 0 in the column's own units, for example latitude 0°.
• Deferred to separate PRs: Angular 22 (OnPush by default) and Pyodide 314 (pandas 3).

[dkammer]

The current state looks good.

We still have a problem with "text" columns. We surely would like to keep this information in the tooltips, for example, but not in the projection. Right now, it seems that all columns selected in step 2 are included and the selection in step 4 is ignored (at least in the primary FastMap method).

Attached example dataset: cheese_details
cheese_details_csv.csv

@Thorfinson Could you look into this as well during this merge request?