4 Commits

Include renames

Author	SHA1	Message	Date
fen	7a74ff3e74	Fix #139: drop unsafe-inline from script-src and style-src (#139) ... - Move all inline <script> blocks (layout head/theme, topbar dark toggle, foot, paste, new, history, mine, settings, admin, unlock) to external files under internal/web/static/. Page data reaches scripts via data-* attributes (data-paste-id, data-default-dark) instead of template vars. - Replace inline onclick handlers (copy, delete, stats toggle) with addEventListener wiring. - Convert inline style="" attributes to CSS utility classes; swatch colors are now set via CSSOM/DOM APIs instead of innerHTML strings. - script-src/style-src are now plain 'self'; img-src data: stays for the SVG data-URI backgrounds. Verified with headless chromium: zero CSP violations on all pages in dark and light presets, theme swatches, admin lock, tables and paste view render correctly.	2026-09-10 09:08:17 -05:00
fen	fa2e9b1bb5	History: keep pagination over filtered/sorted set, pin pager to page bottom (#133)	2026-09-09 22:48:25 -05:00
poslop	c288fc73a7	Search: spinner indicator + performance note on client-side filtering (#32) ... - Fix filter fetch to request limit=100 (API max) instead of 500, which the API silently clamped, so filtered results actually cover the fetch window. - Document client-side filtering behavior and limits in README Performance Notes.	2026-09-09 09:13:40 -05:00
poslop	4f1e901f04	Refactor: split monolith into cmd/palette + internal/{store,api,web,lang} (#35)	2026-09-09 01:33:39 -05:00