feat(security): add Content-Security-Policy headers with strict script-src

Eliminate all inline scripts to enable script-src 'self' without
'unsafe-inline', providing strong XSS mitigation via CSP.

Inline script removal:
- login.phtml: replace inline APP_ASSET_BASE with data-asset-base
  attribute + app-boot.js (matching default.phtml pattern)
- api-docs: extract SwaggerUI init to js/pages/admin-api-docs-index.js
- docs: extract checkbox enablement to js/pages/admin-docs-index.js
- language-switcher: replace onchange handler with data-auto-submit
  attribute + js/components/app-auto-submit.js event listener

CSP policy (dev + prod nginx):
  default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline';
  img-src 'self' data:; font-src 'self'; connect-src 'self';
  form-action 'self'; base-uri 'self'; frame-ancestors 'none';
  manifest-src 'self'

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

pages/admin/api-docs/index(default).phtml

@@ -8,29 +8,8 @@ require templatePath('partials/app-breadcrumb.phtml');
 ?>
 
 <div class="app-swagger-container">
-  <div id="swagger-ui"></div>
+  <div id="swagger-ui" data-spec-url="<?php e($specUrl); ?>"></div>
 </div>
 
 <script src="<?php e(assetVersion('vendor/swagger-ui/swagger-ui-bundle.js')); ?>"></script>
-<script>
-  window.addEventListener('DOMContentLoaded', function () {
-    if (!window.SwaggerUIBundle) {
-      return;
-    }
-
-    window.SwaggerUIBundle({
-      url: '<?php e($specUrl); ?>',
-      dom_id: '#swagger-ui',
-      deepLinking: false,
-      displayRequestDuration: true,
-      filter: true,
-      docExpansion: 'list',
-      supportedSubmitMethods: [],
-      tryItOutEnabled: false,
-      presets: [
-        window.SwaggerUIBundle.presets.apis,
-      ],
-      layout: 'BaseLayout'
-    });
-  });
-</script>
+<script type="module" src="<?php e(assetVersion('js/pages/admin-api-docs-index.js')); ?>"></script>