fix(csp): remove all inline styles, scripts, and event handlers for strict CSP compliance

Replace ~50 inline style="" attributes with CSS classes, move 3 inline
<script> blocks to external JS files, replace all inline event handlers
(onclick, onerror) with addEventListener, and remove createElement('style')
from icons.js. All changes support the strict CSP policy (style-src 'self';
script-src 'self') without weakening it.

static/js/core/icons.js

@@ -101,33 +101,7 @@ const _ICONS = {
   "vial": [512, "M342.6 9.4c-12.5-12.5-32.8-12.5-45.3 0s-12.5 32.8 0 45.3l9.4 9.4L28.1 342.6C10.1 360.6 0 385 0 410.5L0 416c0 53 43 96 96 96l5.5 0c25.5 0 49.9-10.1 67.9-28.1L448 205.3l9.4 9.4c12.5 12.5 32.8 12.5 45.3 0s12.5-32.8 0-45.3l-32-32-96-96-32-32zM205.3 256L352 109.3 402.7 160l-96 96-101.5 0z"],
 };
 
-// ── CSS injection ──────────────────────────────────────────────
-// Injects minimal CSS for SVG icons (replaces ~80 KB of FA CSS).
-
-(function injectIconCSS() {
-  if (document.getElementById("oxi-icon-css")) return;
-  const style = document.createElement("style");
-  style.id = "oxi-icon-css";
-  style.textContent = `
-.oxi-icon {
-  display: inline-block;
-  width: 1em;
-  height: 1em;
-  vertical-align: -0.125em;
-  fill: currentColor;
-  overflow: hidden;
-  flex-shrink: 0;
-}
-.oxi-icon-spin {
-  animation: oxi-spin 1s linear infinite;
-}
-@keyframes oxi-spin {
-  from { transform: rotate(0deg); }
-  to   { transform: rotate(360deg); }
-}
-`;
-  document.head.appendChild(style);
-})();
+// Icon CSS is now in /css/components/icons.css (loaded via main.css).
 
 // ── Public API ─────────────────────────────────────────────────