fix: generalize access-request service classification and stat cards in analytics template (#4922)

[frano-m]

Closes #4922

What changed

All changes are in the shared static analytics template (analytics/analytics_package/analytics/static_site/template/index.html), fixing items 1–4 of #4909:

• serviceName() generalized and hardened: matches known services case-insensitively (parity with fetch.py's case=False filtering), buckets unknown services by hostname (tolerating schemeless URLs, stripping www. so host variants merge), and returns "Other" for missing, non-string, or unparseable URLs.
• Stats cards generic over N services: the access-requests stats grid is built from a single service→count reduce — one card per present service plus Total, alphabetically sorted, laid out with grid-template-columns: repeat(N, 1fr) so any card count fills the row evenly (with a mobile override so cards still stack under 768px). Previously exactly dbGaP/DUOS/Total were hardcoded, so a third service was counted in Total but got no card.
• Robust data handling: access_requests.json is now fetched in loadData's Promise.all alongside the other optional files (no extra serialized round-trip), rows are validated (Array.isArray, non-object rows filtered, counts coerced with Number(...) || 0), total is derived from the per-service counts so the cards always sum, and the render call is isolated in its own try/catch so a bad optional payload can't blank the rest of the report.

How verified

• Node logic tests for serviceName() (mixed-case, schemeless, www. variants, non-hierarchical URLs, non-strings, null/undefined) and the count/grid arithmetic.
• Playwright rendering tests against a local server: synthetic multi-service data with hostile rows (string count, numeric click_url, null row) — 5 cards on one even row, totals sum correctly (15+2+2+3=22, table header agrees); real anvil-explorer data — single-service behavior unchanged (no stats grid, no Service column); object-instead-of-array payload — section hidden, rest of report intact, zero JS errors.
• Two /code-review rounds; all confirmed findings fixed. One deliberate skip: moving the DUOS/dbGaP label mapping into the Python export layer (changes the data contract; candidate follow-up ticket).

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR updates the shared static analytics HTML template to make access-request service classification more robust and to render access-request “stat cards” dynamically for any number of services, improving correctness when new/unknown services appear in the data.

Changes:

• Hardened and generalized serviceName() (case-insensitive matching; hostname bucketing for unknowns; “Other” fallback).
• Made access-request stat cards data-driven (service→count reduce; alphabetical service cards plus Total; dynamic grid columns with mobile override).
• Improved optional access-requests loading and rendering isolation (best-effort fetch; array validation; defensive coercions; render wrapped to avoid impacting the rest of the report).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.