fix(security): safe links and security headers (FLAW-28, FLAW-29)

safeHref lets only http, https and mailto become links (Markdown viewer,
outliner, legal links); javascript: and friends show as text. A
middleware sets a Content-Security-Policy (scripts only from MindSift,
no framing, connections only to this server), X-Frame-Options,
nosniff, Referrer-Policy and a Permissions-Policy. The two inline
scripts of index.html moved to files so script-src stays 'self'.

The second inline script also deleted every cache on each page load,
which undermined the offline start; it is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/lib/markdown.tsx

@@ -1,4 +1,5 @@
 import React from 'react';
+import { safeHref } from './safeUrl';
 
 /**
  * Parses inline markdown:
@@ -86,9 +87,9 @@ function renderInlineTokens(text: string, options?: InlineMarkdownOptions): Reac
           {token.slice(2, -2)}
         </del>
       );
-    } else if (token.startsWith('[') && match[2] && match[3]) {
+    } else if (token.startsWith('[') && match[2] && match[3] && safeHref(match[3])) {
       const label = match[2];
-      const url = match[3];
+      const url = safeHref(match[3]) as string;
       elements.push(
         <a
           key={key}