Fix diagnostic sweep bugs — tags, random, 404s, security headers

- Tags: data.TagCollection→data.MediaTagCollection (was returning empty array)
- Random: Math.random()*50→crypto.randomInt(1,500) for true randomness
- Character/Staff: return 404 instead of 500 on not-found
- Security: added X-XSS-Protection header
- All 44 endpoints tested in full diagnostic sweep

server.js

@@ -113,6 +113,7 @@ app.use((req, res, next) => {
 app.use((req, res, next) => {
   res.setHeader("X-Frame-Options", "DENY");
   res.setHeader("X-Content-Type-Options", "nosniff");
+  res.setHeader("X-XSS-Protection", "1; mode=block");
   res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
   res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
   res.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=()");

src/helpers/anilist.js

@@ -609,7 +609,7 @@ const getAllGenres = async () => {
 const getAllTags = async () => {
   const gql = `query { MediaTagCollection { name description category isGeneralSpoiler isMediaSpoiler isAdult } }`;
   const data = await anilistQuery(gql);
-  return data.TagCollection;
+  return data.MediaTagCollection;
 };
 
 // ══════════════════════════════════════════════════════════════

src/routes/apiRoutes.js

@@ -320,8 +320,9 @@ const createApiRoutes = (jsonResponse, jsonError, startTime) => {
   // ---- FEATURE: Random anime of the day ----
   router.get("/random", async (req, res) => {
     try {
-      // NOTE: Get random page from trending to ensure variety
-      const randomPage = Math.floor(Math.random() * 50) + 1;
+      // NOTE: Use crypto for better randomness in serverless + wider range for variety
+      const crypto = require("crypto");
+      const randomPage = crypto.randomInt(1, 500);
       const data = await anilist.getCollection("POPULARITY_DESC", null, randomPage, 1);
       const anime = data.results[0];
 
@@ -505,7 +506,8 @@ const createApiRoutes = (jsonResponse, jsonError, startTime) => {
 
       jsonResponse(res, result);
     } catch (err) {
-      jsonError(res, err.message);
+      const status = err.message.includes("not found") ? 404 : 500;
+      jsonError(res, err.message, status);
     }
   });
 
@@ -524,7 +526,8 @@ const createApiRoutes = (jsonResponse, jsonError, startTime) => {
 
       jsonResponse(res, result);
     } catch (err) {
-      jsonError(res, err.message);
+      const status = err.message.includes("not found") ? 404 : 500;
+      jsonError(res, err.message, status);
     }
   });