fix(csp): remove all inline styles, scripts, and event handlers for strict CSP compliance

Replace ~50 inline style="" attributes with CSS classes, move 3 inline
<script> blocks to external JS files, replace all inline event handlers
(onclick, onerror) with addEventListener, and remove createElement('style')
from icons.js. All changes support the strict CSP policy (style-src 'self';
script-src 'self') without weakening it.

static/js/core/notifications.js

@@ -153,7 +153,7 @@ const notifications = (() => {
             <div class="notif-item-icon upload"><i class="fas fa-cloud-upload-alt"></i></div>
             <div class="notif-item-body">
                 <div class="notif-item-title">${uploadingText}</div>
-                <div class="notif-upload-current" id="${batchId}-current" style="font-size:11px;color:#64748b;margin:3px 0;white-space:nowrap;overflow:hidden;text-overflow:ellipsis;"></div>
+                <div class="notif-upload-current" id="${batchId}-current"></div>
                 <div class="notif-upload-progress">
                     <div class="notif-upload-bar"><div class="notif-upload-fill" id="${batchId}-fill"></div></div>
                     <div class="notif-upload-detail">