Clean up issues

Problem/Motivation

Claude identified the following issues:

1. Inappropriate Language — js/archive-sites-menu.js:6
The function name and JSDoc are not suitable for a contrib theme:

function navigateYourAss(e) { // line 6
// "Navigates the user's ass to the selected URL."
This must be renamed before any public release.

2. Hardcoded English Strings (Not Translated) — event_horizon.theme:317,322
The login form modifications bypass t():

$form['actions']['submit']['#value'] = 'Login'; // line 317 — not translatable
$form['#prefix'] = '
Login

'; // line 322 — not translatable
Both strings need t(). The #prefix/#suffix pattern also bypasses Drupal's render API — this should use a render array:

'#prefix' => '
' . t('Login') . '

',
3. Hardcoded Timezone Offset — js/schedule.js:18
The "Jump to current time slot" feature hardcodes US Eastern Time:

const dateStringWithTimeZone = dateOfActiveScheduleTab + 'T00:00:00.000-05:00';
This is a contrib theme — events in other timezones will get completely wrong behavior (or no "Jump" button at all). The timezone should come from Drupal's drupalSettings (populated from the site config via DateTimeZone) rather than being hardcoded.

4. Cache Tag Bug — event_horizon.theme:95-135
The $cache_tag variable is defined in both branches but never applied to $variables['#cache']['tags'] in the else branch:

// Line 98 — $cache_tag is set but never used:
$cache_tag = 'config_pages_list';

// Line 135 — only this runs, but when $event_details is null, this becomes 'config_pages:':
$variables['#cache']['tags'][] = 'config_pages:' . $event_details?->id();
When no event_details config page exists yet, the cache will never be invalidated when one is created. Fix:

$variables['#cache']['tags'][] = $event_details
? 'config_pages:' . $event_details->id()
: 'config_pages_list';
5. Invalid .info.yml Key — event_horizon.info.yml:5

alt text: 'theme swesomeness that is out of this galaxy'
alt text is not a valid Drupal theme .info.yml key and will be silently ignored. There's also a typo (swesomeness). Remove this line or replace with screenshot: if you want to provide a theme preview image.

6. XSS Risk: ${text} Injected via innerHTML — js/messages.js:103

messageWrapper.innerHTML = `
...

`;
The text parameter comes from Drupal.Message and may contain HTML (e.g., links in system messages). While this mirrors Drupal Core's own message theme function, the theme is directly responsible for this markup. If any upstream module passes unsanitized user input into a message, this becomes XSS. Adding a comment acknowledging this intentional pattern (following core) would at minimum document the decision.

7. Large Blocks of Commented-Out Dead Code — event_horizon.theme
Several substantial commented-out blocks should be removed before stable:

event_horizon.theme:147-149 — mobile menu width class (commented with //)
event_horizon.theme:200-215 — 15-line Olivero subtheme porting code
event_horizon.theme:490-500 — speakers field name override
event_horizon.theme:628 — orphaned "Overwrites the Olivero default." comment on a function that isn't overwriting Olivero anything
8. Dynamic String Passed to t() — theme-settings.php:149

'#title' => t($title), // $title is a variable
t() with a variable argument defeats static string extraction tools and PHPCS will flag this. The titles 'Primary base color' / 'Secondary base color' are defined just above as array literals — inline them as literal strings with t() directly.

Summary Table
Priority Issue File:Line
Must fix Inappropriate function name/comment archive-sites-menu.js:6
Must fix Hardcoded untranslated "Login" strings event_horizon.theme:317,322
High Hardcoded Eastern timezone offset schedule.js:18
High Cache tag never applied in else branch event_horizon.theme:95-135
High Invalid alt text key in info.yml event_horizon.info.yml:5
Medium ${text} innerHTML injection in messages messages.js:103
Low Large commented-out dead code blocks event_horizon.theme:147,200,490
Low Dynamic variable passed to t() theme-settings.php:149
The security posture is generally solid — no raw Twig filters, proper Drupal API usage throughout, and file upload validation is in place. The three must-fix items and the cache tag bug are the most pressing before tagging 1.0.0.

Proposed resolution

Address the cited issues.