v1.23.0: Harden dashboard Content-Security-Policy and decouple inline assets

Security Hardening & Asset Decoupling (#204, #205)

• Hardened Content-Security-Policy (CSP):
  • Eliminated 'unsafe-inline' and external CDN script origins (https://cdn.tailwindcss.com) from both FastAPI application headers and Nginx reverse proxy configuration.
  • Enforced strict script-src 'self' and object-src 'none' directives for defense-in-depth against cross-site scripting (XSS).
• Decoupled Frontend Assets:
  • Extracted ~500 lines of inline JavaScript from index.html into a standalone, cacheable dashboard.js.
  • Replaced inline event handlers (onclick, oninput, onchange) with decoupled addEventListener registrations.
  • Bundled scoped CSS utility classes directly into dashboard.css, making the dashboard 100% self-contained and air-gap compatible.
• Serving & Multi-Stage Packaging:
  • Added dedicated static asset endpoints (/dashboard.js, /dashboard.css, /static/*) in the backend web application.
  • Packaged static assets into the standalone cf-tunnel-dashboard container.
• Documentation & Verification:
  • Updated API and security documentation in docs/api.md and docs/security.md.
  • Updated DOM sanitization, isolation, and observability regression test suites.

Validation & Reviews

• All 364 tests and 36 subtests passing cleanly.
• CodeQL analysis, OSV security scans, and CI gates passed green.
• Reviews approved by @MustermenschAlex and @kuenstlichedummheit-sys.