Remove 'unsafe-inline' from Content-Security-Policy

[emilhauk]

The security headers middleware (added in internal/middleware/headers.go) currently uses 'unsafe-inline' for both script-src and style-src in the CSP. This is a pragmatic baseline but weakens the protection CSP provides against XSS.

Steps to remove 'unsafe-inline'

1. Add per-request nonce generation to tmpl.Renderer — generate a cryptographic random nonce for each request, make it available to templates via pageData, and inject nonce="..." on all <script> tags in base.html and room.html.

2. Migrate inline event handlers to external JS — three inline handlers need to move to addEventListener in external JS modules:

   • onclick in base.html
   • onclick in room-panel.html
   • onkeydown in room.html

3. Update CSP to use 'nonce-{value}' — replace 'unsafe-inline' with 'nonce-{value}' in script-src. The middleware will need access to the per-request nonce (e.g. via response header or context value).

4. Evaluate style-src — determine whether 'unsafe-inline' can also be dropped from style-src (check for inline style="" attributes and any dynamically set styles in JS).

Context

The current CSP still provides value by restricting connect-src, frame-src, object-src, base-uri, and form-action. Removing 'unsafe-inline' from script-src is the highest-impact improvement.