fix(member-live): guard the composite sort event and apply review cleanup

lib/mv_web/live/components/member_name_sort_header.ex

@@ -74,6 +74,7 @@ defmodule MvWeb.Components.MemberNameSortHeader do
         aria-label={gettext("Choose sort field")}
         aria-describedby="member-subfield-tooltip"
         aria-haspopup="menu"
+        aria-controls="member-subfield-menu"
         aria-expanded="false"
         phx-hook="SubfieldMenu"
         data-menu-id="member-subfield-menu"

lib/mv_web/live/member_live/index.ex

@@ -226,7 +226,7 @@ defmodule MvWeb.MemberLive.Index do
 
   # Number of members fetched per keyset page (matches the :overview action's
   # default_limit). Mount loads one page; further pages arrive via infinite
-  # scroll (phx-viewport-bottom) so the socket never holds the full table.
+  # scroll (an IntersectionObserver sentinel) so the socket never holds the full table.
   @page_limit 50
 
   # -----------------------------------------------------------------
@@ -384,12 +384,17 @@ defmodule MvWeb.MemberLive.Index do
 
   # The composite "Member" column's sub-field menu (first name / last name) always
   # sorts ascending by the chosen field: it switches the sort key rather than
-  # toggling direction (a click on the header itself toggles direction).
-  def handle_event("sort_composite", %{"field" => field_str}, socket) do
-    field = String.to_existing_atom(field_str)
-    {:noreply, apply_sort_change(socket, field, :asc)}
+  # toggling direction (a click on the header itself toggles direction). The field
+  # is allow-listed to the two real sub-fields, so a crafted event payload cannot
+  # reach String.to_existing_atom with an unknown atom (which would crash the LV).
+  @impl true
+  def handle_event("sort_composite", %{"field" => field}, socket)
+      when field in ["first_name", "last_name"] do
+    {:noreply, apply_sort_change(socket, String.to_existing_atom(field), :asc)}
   end
 
+  def handle_event("sort_composite", _params, socket), do: {:noreply, socket}
+
   # Applies a resolved (field, order) sort: updates assigns and the sort-header
   # components, reloads the keyset stream from page 1, scrolls to top, and syncs
   # the URL. Shared by the header-click ("sort") and sub-field menu
@@ -1268,7 +1273,7 @@ defmodule MvWeb.MemberLive.Index do
   end
 
   # Fetches the next keyset page (if any) and appends it to the stream and the
-  # loaded window. Triggered by phx-viewport-bottom; a no-op once the last page
+  # loaded window. Triggered by the IntersectionObserver sentinel; a no-op once the last page
   # has been reached so the bottom sentinel stops fetching.
   defp load_more(%{assigns: %{more?: false}} = socket), do: socket