fix(security): safe links and security headers (FLAW-28, FLAW-29)

safeHref lets only http, https and mailto become links (Markdown viewer,
outliner, legal links); javascript: and friends show as text. A
middleware sets a Content-Security-Policy (scripts only from MindSift,
no framing, connections only to this server), X-Frame-Options,
nosniff, Referrer-Policy and a Permissions-Policy. The two inline
scripts of index.html moved to files so script-src stays 'self'.

The second inline script also deleted every cache on each page load,
which undermined the offline start; it is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/lib/safeUrl.ts

@@ -0,0 +1,16 @@
+// Links from user content (notes, task notes, Markdown) may only point to web pages or mail addresses.
+// Anything else – javascript:, data:, vbscript:, file: and friends – would run or load in the app's
+// context when clicked, so it is shown as plain text instead (FLAW-28).
+const ALLOWED_PROTOCOLS = new Set(['http:', 'https:', 'mailto:']);
+
+export function safeHref(raw: string): string | null {
+  const value = raw.trim();
+  if (!value) return null;
+  try {
+    // Browsers ignore control characters and whitespace inside the scheme ("java\tscript:"); URL does the same
+    const url = new URL(value);
+    return ALLOWED_PROTOCOLS.has(url.protocol) ? url.href : null;
+  } catch {
+    return null; // relative or broken: not a link
+  }
+}