Hot-reload: atomic pointer swap of RuleSet after any rule mutation (create/delete/patch). Rebuilds from static blocklists + DB rules. Element hiding refactor: CSS display:none injection only — no more DOM stripping of content elements. Generic EasyList selectors were matching body children and causing blank pages. Src-based stripping kept only for script/iframe/object/embed with blocked URLs (performance benefit). Security hardening: - Sanitize CSS before injecting into <style> tags (prevent </style> XSS) - HTML-encode URLs in blocked-resource comments (prevent comment injection) - Add transport timeouts (TLS handshake 10s, response header 60s, idle 90s) - Add client TLS handshake deadline (10s) to prevent goroutine leaks - Panic recovery in async reload goroutine Deleted: pkg/blocklist/selector.go, pkg/blocklist/selector_test.go (selector matching/classification code no longer needed)