Fix #139: drop unsafe-inline from script-src and style-src (#139)

- Move all inline <script> blocks (layout head/theme, topbar dark toggle,
  foot, paste, new, history, mine, settings, admin, unlock) to external
  files under internal/web/static/. Page data reaches scripts via data-*
  attributes (data-paste-id, data-default-dark) instead of template vars.
- Replace inline onclick handlers (copy, delete, stats toggle) with
  addEventListener wiring.
- Convert inline style="" attributes to CSS utility classes; swatch
  colors are now set via CSSOM/DOM APIs instead of innerHTML strings.
- script-src/style-src are now plain 'self'; img-src data: stays for the
  SVG data-URI backgrounds. Verified with headless chromium: zero CSP
  violations on all pages in dark and light presets, theme swatches,
  admin lock, tables and paste view render correctly.

internal/web/templates/paste.html

@@ -8,13 +8,13 @@
       <div class="spacer"></div>
       <button type="button" class="iconbtn wrap-toggle" title="Toggle line wrap" aria-pressed="false">wrap</button>
       <a class="iconbtn" href="/raw/{{.ID}}">raw</a>
-      <a class="iconbtn" href="#" id="copy-btn" onclick="copyContent(this); return false;">copy</a>
-      {{if .DeletionToken}}<a class="iconbtn danger" href="#" onclick="redeem(); return false;">delete</a>{{end}}
+      <a class="iconbtn" href="#" id="copy-btn">copy</a>
+      {{if .DeletionToken}}<a class="iconbtn danger" href="#" id="delete-btn">delete</a>{{end}}
     </div>
   </div>
   <div class="float">
     <div class="stats-pill" id="stats-pill">
-      <button type="button" class="stats-head" id="stats-toggle" aria-expanded="false" onclick="toggleStats()">
+      <button type="button" class="stats-head" id="stats-toggle" aria-expanded="false">
         <svg class="stats-chev" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true"><polyline points="6 9 12 15 18 9"/></svg>
         <span class="stats-summary">{{.StatsSummary}}</span>
       </button>
@@ -35,7 +35,7 @@
   </div>
   {{if .JustCreated}}
   <div class="float">
-    <div class="created-banner" style="display:block">
+    <div class="created-banner">
       Paste created. Link copied to clipboard: <a href="/{{.ID}}">{{.Host}}/{{.ID}}</a>
       {{if .DeletionToken}} · deletion token: <code>{{.DeletionToken}}</code>{{end}}
     </div>
@@ -59,43 +59,5 @@
   </div>
 </div>
 <input type="hidden" id="raw-content" value="{{.ContentAttr}}">
-<script>
-function toast(msg) {
-  let t = document.querySelector('.toast');
-  if (!t) { t = document.createElement('div'); t.className = 'toast'; document.body.appendChild(t); }
-  t.textContent = msg;
-  t.classList.add('show');
-  clearTimeout(t._h);
-  t._h = setTimeout(() => t.classList.remove('show'), 2000);
-}
-function toggleStats() {
-  const body = document.getElementById('stats-body');
-  const pill = document.getElementById('stats-pill');
-  const btn = document.getElementById('stats-toggle');
-  const open = body.hidden;
-  body.hidden = !open;
-  pill.classList.toggle('open', open);
-  btn.setAttribute('aria-expanded', open ? 'true' : 'false');
-}
-function copyContent(btn) {
-  navigator.clipboard.writeText(document.getElementById('raw-content').value);
-  // in-place success feedback (#53)
-  if (btn) {
-    btn.classList.add('ok');
-    btn.textContent = 'Success!';
-    clearTimeout(btn._okh);
-    btn._okh = setTimeout(() => { btn.classList.remove('ok'); btn.textContent = 'copy'; }, 2000);
-  } else {
-    toast('Copied', 'success');
-  }
-}
-function redeem() {
-  if (!confirm('Hard delete this paste immediately?')) return;
-  let tok = '';
-  try { tok = sessionStorage.getItem('deletion_token_{{.ID}}') || ''; } catch(e) {}
-  if (!tok) { alert('deletion token not available in this browser'); return; }
-  fetch('/api/pastes/{{.ID}}/redeem', {method: 'DELETE', headers: {'Authorization': 'Bearer ' + tok}})
-    .then(r => { if (r.ok) location.href = '/history'; else alert('delete failed'); });
-}
-</script>
+<script src="/static/paste.js" defer data-paste-id="{{.ID}}"></script>
 {{template "foot" .}}