<ul><li>HomeController.php line 675: catch block used echo "Error: ".msg (plain text) before JSON response — since ob_end_clean() is called before the method runs, this output went directly to the client, making the full response "Error: ...{json}" which is invalid JSON. Fixed: catch block now returns json_encode error array and exits early.</li><li>HomePageManager/js/custom_js.php: Added safeJsonParse() helper wrapping JSON.parse in try/catch. Replaced all 9 bare JSON.parse(res) calls with safeJsonParse(res) — prevents Uncaught SyntaxError when server returns plain-text error.</li><li>HomePageManager/page/banner.php: Added safeJsonParse() helper. Replaced all 3 bare JSON.parse(result) calls with safeJsonParse(result).</li><li>Apache youportal-servers.conf: Added Permissions-Policy header allowing picture-in-picture for self, youtube.com, and youtube-nocookie.com — eliminates [Violation] Permissions policy violation: picture-in-picture console warnings from YouTube iframes.</li></ul>