Fix #139: drop unsafe-inline from script-src and style-src (#139)

- Move all inline <script> blocks (layout head/theme, topbar dark toggle,
  foot, paste, new, history, mine, settings, admin, unlock) to external
  files under internal/web/static/. Page data reaches scripts via data-*
  attributes (data-paste-id, data-default-dark) instead of template vars.
- Replace inline onclick handlers (copy, delete, stats toggle) with
  addEventListener wiring.
- Convert inline style="" attributes to CSS utility classes; swatch
  colors are now set via CSSOM/DOM APIs instead of innerHTML strings.
- script-src/style-src are now plain 'self'; img-src data: stays for the
  SVG data-URI backgrounds. Verified with headless chromium: zero CSP
  violations on all pages in dark and light presets, theme swatches,
  admin lock, tables and paste view render correctly.

internal/web/static/app.css

@@ -725,3 +725,20 @@ button[type="submit"]:focus-visible,
 .attachment-chip:hover { border-color: var(--accent); }
 .attachment-chip .attachment-size { color: var(--muted-fg); font-size: 19px; }
 .attachment-preview img { max-width: 480px; max-height: 360px; border-radius: var(--radius); border: 1px solid var(--border); }
+
+/* #139: CSP-safe replacements for inline style attributes (style-src 'self') */
+.hidden { display: none; }
+.can-page { max-width: 900px; width: 100%; }
+.col-a { width: 260px; } .col-b { width: 140px; } .col-c { width: 120px; }
+.col-d { width: 96px; } .col-d2 { width: 150px; } .col-e { width: 190px; }
+.col-f { width: 100px; } .col-g { width: 190px; }
+.spacer-flex { flex: 1; }
+.input-num { width: 80px; }
+.input-num-sm { width: 64px; }
+.danger-hint { color: var(--danger, #c0392b); margin-top: 6px; }
+.hint-lg { font-size: 19px; }
+.mt6 { margin-top: 6px; }
+.mt18 { margin-top: 18px; }
+.toggle-inline { display: inline-flex; }
+.wrap-normal { word-break: normal; overflow-wrap: break-word; }
+.created-banner { display: block; }