Fix #139: drop unsafe-inline from script-src and style-src (#139)

- Move all inline <script> blocks (layout head/theme, topbar dark toggle,
  foot, paste, new, history, mine, settings, admin, unlock) to external
  files under internal/web/static/. Page data reaches scripts via data-*
  attributes (data-paste-id, data-default-dark) instead of template vars.
- Replace inline onclick handlers (copy, delete, stats toggle) with
  addEventListener wiring.
- Convert inline style="" attributes to CSS utility classes; swatch
  colors are now set via CSSOM/DOM APIs instead of innerHTML strings.
- script-src/style-src are now plain 'self'; img-src data: stays for the
  SVG data-URI backgrounds. Verified with headless chromium: zero CSP
  violations on all pages in dark and light presets, theme swatches,
  admin lock, tables and paste view render correctly.

internal/web/static/table.js

@@ -79,10 +79,10 @@ const PaletteTable = (() => {
         const rows = $('rows'), empty = $('empty');
         if (!items.length) {
           rows.innerHTML = '';
-          empty.style.display = 'block';
+          empty.classList.remove('hidden');
           empty.textContent = filtered ? opts.emptyFiltered : opts.emptyAll;
         } else {
-          empty.style.display = 'none';
+          empty.classList.add('hidden');
           rows.innerHTML = items.map(opts.rowHtml).join('');
         }
 
@@ -97,7 +97,7 @@ const PaletteTable = (() => {
             const view = items.slice(fOff, fOff + opts.perPage);
             rows.innerHTML = view.length ? view.map(opts.rowHtml).join('') : '';
             if (!view.length) {
-              empty.style.display = 'block';
+              empty.classList.remove('hidden');
               empty.textContent = filtered ? opts.emptyFiltered : opts.emptyAll;
             }
             showing.textContent = `Showing ${view.length === 0 ? 0 : fOff+1}–${fOff+view.length} of ${items.length.toLocaleString()} ${filtered ? 'matches' : 'sorted'} · page ${state.page} of ${filtPages}`;