fix: encode consent cookie value; always show details on openConsentPreferences

- encodeURIComponent/decodeURIComponent in setCookie/getCookie so JSON
  characters (quotes, commas) don't violate RFC 6265 cookie-value rules
- showCustomizeOptions() now always sets display=block instead of toggling;
  clicking the footer 'Cookie Preferences' link while banner is open would
  previously hide the details panel instead of reliably showing it

Author: BenjaminMichaelis

EssentialCSharp.Web/wwwroot/js/consent-manager.js

@@ -180,7 +180,7 @@ class ConsentManager {
     showCustomizeOptions() {
         const details = document.getElementById('consent-details');
         if (details) {
-            details.style.display = details.style.display === 'none' ? 'block' : 'none';
+            details.style.display = 'block';
 
             // Load current preferences into checkboxes
             document.getElementById('consent-analytics').checked = 
@@ -394,7 +394,7 @@ class ConsentManager {
         const expires = new Date();
         expires.setTime(expires.getTime() + (days * 24 * 60 * 60 * 1000));
         const secure = window.location.protocol === 'https:' ? ';Secure' : '';
-        document.cookie = `${name}=${value};expires=${expires.toUTCString()};path=/;SameSite=Lax${secure}`;
+        document.cookie = `${name}=${encodeURIComponent(value)};expires=${expires.toUTCString()};path=/;SameSite=Lax${secure}`;
     }
 
     deleteCookie(name) {
@@ -408,7 +408,7 @@ class ConsentManager {
         for (let i = 0; i < ca.length; i++) {
             let c = ca[i];
             while (c.charAt(0) === ' ') c = c.substring(1, c.length);
-            if (c.indexOf(nameEQ) === 0) return c.substring(nameEQ.length, c.length);
+            if (c.indexOf(nameEQ) === 0) return decodeURIComponent(c.substring(nameEQ.length, c.length));
         }
         return null;
     }