fix(csp): remove all inline styles, scripts, and event handlers for strict CSP compliance

Replace ~50 inline style="" attributes with CSS classes, move 3 inline
<script> blocks to external JS files, replace all inline event handlers
(onclick, onerror) with addEventListener, and remove createElement('style')
from icons.js. All changes support the strict CSP policy (style-src 'self';
script-src 'self') without weakening it.

static/js/features/files/search.js

@@ -175,8 +175,8 @@ const search = {
             const emptyState = document.createElement('div');
             emptyState.className = 'empty-state';
             emptyState.innerHTML = `
-                <i class="fas fa-search" style="font-size: 48px; color: var(--empty-icon, #ccc); margin-bottom: 16px;"></i>
-                <p style="color: var(--text-secondary, #64748b);">No results found for this search</p>
+                <i class="fas fa-search empty-state-icon"></i>
+                <p class="search-empty-text">No results found for this search</p>
             `;
             filesGrid.appendChild(emptyState);
             return;