fix(frontend): #37 punti 1,4,5,6 - 502 backend giù, barcode quotato, apici Alpine, paginazione ricette

1. api_client.py: ConnectionError/Timeout restituisce status_code=502 invece
   di 0 (nessuna route confrontava == 0, verificato); i proxy che inoltrano
   resp.get("status_code", 500) ereditano il fix senza altre modifiche.
4. measure.py lookup_barcode: code non stringa -> 400 (prima 500 su
   code.strip()); urllib.parse.quote(code, safe="") prima di comporre l'URL
   verso il backend - un barcode con '/' o '../' non spezza più il path né
   raggiunge altri GET con i permessi dell'utente.
5. Ogni "'{{ _(...) }}'" dentro un attributo Alpine (x-text, :title,
   :placeholder, @click) sostituito con "{{ _(...)|tojson_attr }}": la
   traduzione EN di admin/stations.html:105 ("Clear the station's recipes")
   ha un apostrofo che l'IT non ha, e rompeva quel binding e basta - non è
   un XSS, ma stessa classe di difetto di #10. File toccati: admin/stations,
   admin/users, maker/recipe_list, maker/recipe_editor, maker/task_editor,
   maker/task_drawing, components/caliper_status, measure/select_recipe.
   Le occorrenze dentro <script>...</script> (non attributi) sono fuori
   perimetro per questo punto.
6. statistics.py dashboard(): ciclo sulle pagine (per_page=100, il massimo
   del backend) invece di un'unica chiamata che troncava la tendina ricette
   alla centesima.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/frontend/flask_app/tests/test_api_client_backend_down.py

@@ -0,0 +1,43 @@
+"""#37.1: the backend being unreachable must surface as a real HTTP status.
+
+api_client used to answer a ConnectionError/Timeout with status_code: 0,
+which every proxy route forwards straight through
+(``jsonify(resp), resp.get("status_code", 500)``) as the response's actual
+HTTP status - and 0 is not a valid one (Werkzeug renders it "0 UNKNOWN").
+502 Bad Gateway is what it actually is: this server reached out to another
+one and got nothing back.
+"""
+import requests
+import pytest
+from unittest.mock import patch
+
+from services.api_client import api_client
+
+
+@pytest.mark.parametrize("exc", [requests.ConnectionError("refused"), requests.Timeout("timed out")])
+@pytest.mark.parametrize("method,mocked,call_kwargs", [
+    ("get", "services.api_client.requests.get", {}),
+    ("post", "services.api_client.requests.post", {"data": {}}),
+    ("put", "services.api_client.requests.put", {"data": {}}),
+    ("delete", "services.api_client.requests.delete", {}),
+])
+def test_backend_unreachable_returns_502(flask_app, method, mocked, call_kwargs, exc):
+    with flask_app.test_request_context("/"):
+        with patch(mocked, side_effect=exc):
+            result = getattr(api_client, method)("/api/whatever", **call_kwargs)
+
+            assert result["error"] is True
+            assert result["status_code"] == 502
+            assert result["status_code"] != 0
+
+
+def test_pending_authorisation_route_surfaces_502(logged_in_client):
+    with patch(
+        "services.api_client.requests.get",
+        side_effect=requests.ConnectionError("refused"),
+    ):
+        resp = logged_in_client.get(
+            "/measure/api/measurements/pending-authorisation?version_id=5",
+        )
+    assert resp.status_code == 502
+    assert resp.get_json()["error"] is True

src/frontend/flask_app/tests/test_measure.py

@@ -472,3 +472,43 @@ class TestSaveMeasurement:
         assert resp.status_code == 400
         data = resp.get_json()
         assert data["error"] is True
+
+
+class TestLookupBarcode:
+    """POST /measure/lookup-barcode tests (#37.4)."""
+
+    def test_non_string_code_returns_400_not_500(self, logged_in_client, mock_api_client):
+        """{"code": 5} used to reach code.strip() on an int and crash to a 500."""
+        resp = logged_in_client.post(
+            "/measure/lookup-barcode", json={"code": 5},
+        )
+        assert resp.status_code == 400
+        assert resp.get_json()["error"] is True
+        mock_api_client.get.assert_not_called()
+
+    def test_code_with_slash_is_url_quoted(
+        self, logged_in_client, mock_api_client, monkeypatch,
+    ):
+        """"AB/123" must reach the backend as one path segment, not two."""
+        monkeypatch.setattr("blueprints.measure.Config.STATION_CODE", "ST-TEST")
+        mock_api_client.get_station_recipes.return_value = [{"id": 1}]
+        mock_api_client.get.return_value = {"id": 1, "code": "AB/123"}
+
+        resp = logged_in_client.post(
+            "/measure/lookup-barcode", json={"code": "AB/123"},
+        )
+        assert resp.status_code == 200
+        endpoint = mock_api_client.get.call_args[0][0]
+        assert endpoint == "/api/recipes/code/AB%2F123"
+
+    def test_code_with_path_traversal_is_quoted_not_walked(
+        self, logged_in_client, mock_api_client,
+    ):
+        mock_api_client.get.return_value = {"error": True, "status_code": 404}
+
+        resp = logged_in_client.post(
+            "/measure/lookup-barcode", json={"code": "../users"},
+        )
+        assert resp.status_code == 404
+        endpoint = mock_api_client.get.call_args[0][0]
+        assert endpoint == "/api/recipes/code/..%2Fusers"

src/frontend/flask_app/tests/test_statistics.py

@@ -27,6 +27,32 @@ class TestDashboard:
         assert resp.status_code == 302
         assert "/auth/login" in resp.headers["Location"]
 
+    def test_dashboard_pages_past_the_first_hundred_recipes(
+        self, logged_in_client, mock_api_client,
+    ):
+        """#37.6: a single per_page=100 call used to drop every recipe past #100."""
+        page1 = {
+            "items": [{"id": i, "code": f"REC-{i:03d}"} for i in range(100)],
+            "total": 101,
+            "pages": 2,
+        }
+        page2 = {
+            "items": [{"id": 100, "code": "REC-100"}],
+            "total": 101,
+            "pages": 2,
+        }
+        mock_api_client.get.side_effect = [page1, page2]
+
+        resp = logged_in_client.get("/statistics/dashboard")
+        assert resp.status_code == 200
+        assert mock_api_client.get.call_count == 2
+        assert "REC-100" in resp.get_data(as_text=True)
+
+        first_call = mock_api_client.get.call_args_list[0]
+        second_call = mock_api_client.get.call_args_list[1]
+        assert first_call.kwargs["params"]["page"] == 1
+        assert second_call.kwargs["params"]["page"] == 2
+
 
 class TestRoleRequired:
     """Metrologist role enforcement tests."""

src/frontend/flask_app/tests/test_template_js_syntax.py

@@ -197,6 +197,39 @@ def test_admin_stations_inline_js_is_valid(logged_in_client, mock_admin_api):
     _check_alpine_attributes(html, "/admin/stations")
 
 
+def test_admin_stations_inline_js_is_valid_in_english(logged_in_client, mock_admin_api):
+    """gitea#37.5: the EN catalog is where this page's apostrophe actually is.
+
+    translations/en/LC_MESSAGES/messages.po: msgid "Azzera le ricette della
+    stazione" -> msgstr "Clear the station's recipes" (admin/stations.html:105).
+    The IT source string has no apostrophe, so test_admin_stations_inline_js_is_valid
+    (IT-only) would never have caught this - #37.5's own TEST note calls out
+    the EN render specifically.
+    """
+    mock_admin_api.get.side_effect = [
+        [{
+            "id": 1, "code": "ST-DEFAULT", "name": "Default Station",
+            "location": None, "notes": None, "active": True,
+            "created_by": 1, "created_at": "2026-04-25T10:00:00",
+        }],
+        [{"id": 1, "code": "DEMO-001", "name": "Demo Recipe", "active": True}],
+    ]
+
+    with logged_in_client.session_transaction() as sess:
+        sess["language"] = "en"
+    resp = logged_in_client.get("/admin/stations")
+    assert resp.status_code == 200, resp.data[:300]
+
+    html = resp.data.decode("utf-8")
+    assert "station" in html.lower(), "sanity check: the EN string did render"
+
+    scripts = _INLINE_SCRIPT_RX.findall(html)
+    for i, body in enumerate(scripts):
+        _node_check(body, f"/admin/stations (en) script[{i}]")
+
+    _check_alpine_attributes(html, "/admin/stations (en)")
+
+
 def test_admin_users_inline_js_is_valid(logged_in_client, mock_admin_api):
     """Same guard for /admin/users (reuses the userManagement Alpine pattern)."""
     mock_admin_api.get.return_value = [{