refactor(js): avoid use of window.XXX and move to import/export

- change worker: do not cache html pages (not necessary)
- remove use of window.XXX and maximize import/export,
  this will provide more clarety,
  show circular dependencies + you will benefit IDE help

static/js/views/device-verify/device-verify.js

@@ -1,4 +1,6 @@
 // device-verify.js — Extracted from inline <script> in device-verify.html
+import { getCsrfHeaders } from '../../core/csrf.js';
+
 (() => {
     var API_BASE = window.location.origin;
     var codeInput = document.getElementById('user-code');