fix(csp): remove all inline styles, scripts, and event handlers for strict CSP compliance

Replace ~50 inline style="" attributes with CSS classes, move 3 inline
<script> blocks to external JS files, replace all inline event handlers
(onclick, onerror) with addEventListener, and remove createElement('style')
from icons.js. All changes support the strict CSP policy (style-src 'self';
script-src 'self') without weakening it.

static/css/main.css

@@ -24,6 +24,8 @@
 @import url("./components/multiSelect.css");
 @import url("./components/spinner.css");
 @import url("./components/search.css");
+@import url("./components/icons.css");
+@import url("./components/csp-utilities.css");
 
 /* Theme */
 @import url("./themes/dark.css");