refactor: move frontend JS to external files and enable strict CSP

public/admin.js

@@ -42,7 +42,7 @@ function buildSidebar(active) {
     </nav>
     <div class="bottom">
       <a href="/">На главную</a>
-      <a class="logout" onclick="doLogout()">Выйти</a>
+      <a class="logout" href="#" data-action="logout">Выйти</a>
     </div>`;
 }
 
@@ -137,14 +137,32 @@ function copyText(text) {
 function renderPager(el, page, totalPages, onPage) {
   if (!el) return;
   if (totalPages <= 1) { el.innerHTML = ''; return; }
-  let html = `<button ${page === 1 ? 'disabled' : ''} onclick="(${onPage})(${page - 1})">‹</button>`;
+  let html = `<button ${page === 1 ? 'disabled' : ''} data-nav="-1">‹</button>`;
   for (let i = 1; i <= totalPages; i++) {
     if (totalPages > 9 && i > 2 && i < totalPages - 1 && Math.abs(i - page) > 2) {
       if (i === 3) html += `<button disabled>…</button>`;
       continue;
     }
-    html += `<button class="${i === page ? 'active' : ''}" onclick="(${onPage})(${i})">${i}</button>`;
+    html += `<button class="${i === page ? 'active' : ''}" data-page="${i}">${i}</button>`;
   }
-  html += `<button ${page === totalPages ? 'disabled' : ''} onclick="(${onPage})(${page + 1})">›</button>`;
+  html += `<button ${page === totalPages ? 'disabled' : ''} data-nav="1">›</button>`;
   el.innerHTML = html;
-}
+  el._onPage = onPage;
+  el._page = page;
+  if (!el._bound) {
+    el._bound = true;
+    el.addEventListener('click', e => {
+      const btn = e.target.closest('button');
+      if (!btn || btn.disabled) return;
+      const p = btn.dataset.page ? parseInt(btn.dataset.page, 10) : el._page + parseInt(btn.dataset.nav, 10);
+      if (el._onPage) el._onPage(p);
+    });
+  }
+}
+
+document.addEventListener('click', e => {
+  const imgEl = e.target.closest('[data-img]');
+  if (imgEl) { e.preventDefault(); showImg(imgEl.dataset.img); return; }
+  const out = e.target.closest('[data-action="logout"]');
+  if (out) { e.preventDefault(); doLogout(); }
+});