security: fix vulnerabilities 1-7 from security audit

- Fix #1: Share handler IDOR - enforce owner check on share operations
- Fix #2: list_files_query IDOR - bind folder queries to authenticated user
- Fix #3: Dedup handler IDOR - restrict dedup operations to file owner
- Fix #4: Trash handler OptionalAuthUser - require full AuthUser
- Fix #5: Error info leakage - sanitize 500 error responses
- Fix #6: Chunked upload IDOR - bind upload sessions to user_id,
  add verify_session_owner() check on all session operations
- Fix #7: CSP unsafe-inline removal - migrate all inline scripts,
  styles and event handlers to external files, tighten CSP to
  script-src 'self'; style-src 'self'

New files:
  - static/js/core/theme-init.js (render-blocking theme init)
  - static/js/core/sw-register.js (service worker registration)
  - static/css/views/device-verify.css (extracted inline styles)
  - static/js/views/device-verify/device-verify.js (extracted inline script)

static/js/views/admin/admin.js

@@ -407,3 +407,28 @@ function showAccessDenied() {
 }
 
 init();
+
+/* ── Event-listener wiring (replaces inline onclick/onchange) ── */
+document.getElementById('tab-btn-dashboard').addEventListener('click', function(){ switchTab('dashboard', this); });
+document.getElementById('tab-btn-users').addEventListener('click', function(){ switchTab('users', this); });
+document.getElementById('tab-btn-oidc').addEventListener('click', function(){ switchTab('oidc', this); });
+
+document.getElementById('ds-registration').addEventListener('change', function(){ toggleRegistration(this.checked); });
+
+document.getElementById('btn-create-user').addEventListener('click', openCreateUserModal);
+document.getElementById('prev-btn').addEventListener('click', prevPage);
+document.getElementById('next-btn').addEventListener('click', nextPage);
+
+document.getElementById('discover-btn').addEventListener('click', testConnection);
+document.getElementById('btn-copy-callback').addEventListener('click', copyCallback);
+document.getElementById('btn-test-oidc').addEventListener('click', testConnection);
+document.getElementById('save-btn').addEventListener('click', saveOidcSettings);
+
+document.getElementById('btn-close-quota').addEventListener('click', closeQuotaModal);
+document.getElementById('btn-save-quota').addEventListener('click', saveQuota);
+
+document.getElementById('btn-close-create-user').addEventListener('click', closeCreateUserModal);
+document.getElementById('cu-submit').addEventListener('click', submitCreateUser);
+
+document.getElementById('btn-close-reset-pw').addEventListener('click', closeResetPasswordModal);
+document.getElementById('rp-submit').addEventListener('click', submitResetPassword);