feat(test-page): polished install/test landing, CSP-clean

Rework the public test/install page to match the extension's calm design and
to drop inline scripts/handlers.

- app.css: new stylesheet matching the popup design tokens, with light/dark via
  prefers-color-scheme.
- app.js: extracted from the inline <script>; buttons are wired with
  addEventListener keyed by data-action (no onclick=). Result panels and the
  event log are built with createElement/textContent — no innerHTML with
  interpolated signed-event fields or error messages.
- index.html: cleaner brand header, status card, a numbered install flow with
  code blocks, colour-coded notices, and key-management/signing test sections.
  Links external app.css/app.js; no inline <style> or <script> remain.

Co-Authored-By: jjohare <github@thedreamlab.uk>

Author: jjohare