JS: fix remaining ESLint no-undef findings (undeclared variables, several latent bugs)

🤖 Written by Claude

Triaging the ~149 remaining `no-undef` ESLint warnings in first-party JavaScript (follow-up to #1585) found that most were function-local variables assigned without `let`/`const` (silently leaking globals) or cross-file/template globals not yet declared in the ESLint config — plus a few genuine bugs:

**Latent bugs**
- `citations.js:148` — error branch appends the abstract to `detailContainer`, which is not defined anywhere (ReferenceError if reached). Intended target is `citDom`, matching the rest of `renderData`. The branch is also currently unreachable because `renderData` early-returns when `citation.error` is set.
- `datatable_definition.js:582` — `dom.append($(separator))` should be `$(settings.separator)`; would throw a ReferenceError whenever a datatable config sets `separator` (no config currently does).
- `vc_form.js:676-678` — a `switch` assigns icon HTML to an undeclared `icon` that nothing reads; superseded by `this.iconForSeverity()`. Dead code.
- `vc_links.js:58` — `EMPTY_LINK` is assigned as an implicit global and its only consumer was removed in an earlier commit; now unused.

**Undeclared locals leaking globals** — `flags.js` (`flagTypes`, `sendParams`, `shouldScroll`, `modalDialog`, `parts`, `oldTimestamp`, `action`), `vc_form.js` (`vc_value`, `descriptionSpan`, `eKeysBase`), `vc_diff.js` (`clinSigText`, `valueCounts`), `panel_app.js` (`mohDiv`, `penetranceDiv`, `evidencesUl`, `phenotypesUl`), `venn_intersect.js` (`toggled`, `venn_flag`, `radius`, `get_venn_flag`, `toggleColor`), `analysis_nodes.js` (`source`), `datatable_definition.js` (`for (value of data)`), `samplenode.js` (`SIDE_LENGTH`, `DEFAULT_SHADOW_COLOR`).

**Intentional shared globals needing declaration in eslint.config.mjs** — cross-file functions (`addNodesToDOM`, `getValue`, `venn2`, `Flags`, `VCLinks`, etc.), template-injected globals (`secondWindow`, `panelResizeTimeout`, `ANALYSIS_TAGS_NODE_ID`, `registerComponent`, etc.), and cross-execution state in fragment-loaded files that must stay plain assignments (`seen_igv_error`, `venn_id`, `VENN_TOGGLE_WIDGET_CLASS`, `freq`).

**Note for future linting work:** `analysis_editor_and_grid.html` is AJAX-loaded into `#right-panel` and includes `analysis_includes.html`, so `grid.js` and `venn_intersect.js` re-execute on every analysis load — top-level `let`/`const` must not be added to those files.