feat(security): add Content-Security-Policy headers with strict script-src

Eliminate all inline scripts to enable script-src 'self' without
'unsafe-inline', providing strong XSS mitigation via CSP.

Inline script removal:
- login.phtml: replace inline APP_ASSET_BASE with data-asset-base
  attribute + app-boot.js (matching default.phtml pattern)
- api-docs: extract SwaggerUI init to js/pages/admin-api-docs-index.js
- docs: extract checkbox enablement to js/pages/admin-docs-index.js
- language-switcher: replace onchange handler with data-auto-submit
  attribute + js/components/app-auto-submit.js event listener

CSP policy (dev + prod nginx):
  default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline';
  img-src 'self' data:; font-src 'self'; connect-src 'self';
  form-action 'self'; base-uri 'self'; frame-ancestors 'none';
  manifest-src 'self'

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/js/app-init.js

@@ -22,3 +22,4 @@ import './components/app-custom-field-options-toggle.js';
 import './components/app-tenant-sso-toggle.js';
 import './components/app-settings-telemetry.js';
 import './components/app-standard-detail-page.js';
+import './components/app-auto-submit.js';

web/js/components/app-auto-submit.js

@@ -0,0 +1,12 @@
+/**
+ * Auto-submit: submits the parent form when a [data-auto-submit] element changes.
+ * Replaces inline onchange="this.form.submit()" handlers for CSP compliance.
+ */
+document.querySelectorAll('[data-auto-submit]').forEach((element) => {
+  element.addEventListener('change', () => {
+    const form = element.closest('form');
+    if (form) {
+      form.submit();
+    }
+  });
+});

web/js/pages/admin-api-docs-index.js

@@ -0,0 +1,16 @@
+const container = document.getElementById('swagger-ui');
+
+if (container && window.SwaggerUIBundle) {
+  window.SwaggerUIBundle({
+    url: container.dataset.specUrl || '',
+    dom_id: '#swagger-ui',
+    deepLinking: false,
+    displayRequestDuration: true,
+    filter: true,
+    docExpansion: 'list',
+    supportedSubmitMethods: [],
+    tryItOutEnabled: false,
+    presets: [window.SwaggerUIBundle.presets.apis],
+    layout: 'BaseLayout',
+  });
+}

web/js/pages/admin-docs-index.js

@@ -0,0 +1,3 @@
+document
+  .querySelectorAll('.app-docs-content li > input[type="checkbox"][disabled]')
+  .forEach((checkbox) => checkbox.removeAttribute('disabled'));