fix(csp): remove all inline styles, scripts, and event handlers for strict CSP compliance

Replace ~50 inline style="" attributes with CSS classes, move 3 inline
<script> blocks to external JS files, replace all inline event handlers
(onclick, onerror) with addEventListener, and remove createElement('style')
from icons.js. All changes support the strict CSP policy (style-src 'self';
script-src 'self') without weakening it.

static/css/components/icons.css

@@ -0,0 +1,19 @@
+/* SVG icon base styles (replaces inline <style> from icons.js) */
+.oxi-icon {
+  display: inline-block;
+  width: 1em;
+  height: 1em;
+  vertical-align: -0.125em;
+  fill: currentColor;
+  overflow: hidden;
+  flex-shrink: 0;
+}
+
+.oxi-icon-spin {
+  animation: oxi-spin 1s linear infinite;
+}
+
+@keyframes oxi-spin {
+  from { transform: rotate(0deg); }
+  to   { transform: rotate(360deg); }
+}