refactor: move frontend JS to external files and enable strict CSP

public/login.html

@@ -24,29 +24,10 @@ body{font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;b
 <div class="login">
   <h1>Админ-панель</h1>
   <input type="password" id="pwdInput" placeholder="Пароль" autofocus>
-  <button onclick="doLogin()">Войти</button>
+  <button type="button" id="loginBtn">Войти</button>
   <div class="err" id="loginErr">Неверный пароль</div>
   <div class="back"><a href="/">На главную</a></div>
 </div>
-<script>
-const API = location.origin;
-document.getElementById('pwdInput').addEventListener('keydown', e => { if (e.key === 'Enter') doLogin(); });
-
-async function doLogin() {
-  const pwd = document.getElementById('pwdInput').value;
-  if (!pwd) return;
-  try {
-    const res = await fetch(`${API}/api/stats`, { headers: { 'X-Admin-Token': pwd } });
-    if (res.ok) {
-      sessionStorage.setItem('adminToken', pwd);
-      location.href = 'dashboard.html';
-    } else {
-      document.getElementById('loginErr').style.display = 'block';
-    }
-  } catch {
-    document.getElementById('loginErr').style.display = 'block';
-  }
-}
-</script>
+<script src="js/login.js"></script>
 </body>
 </html>