panel: move inline styles and confirmations out of the templates

Groundwork for the Content-Security-Policy of phase 14.A. A policy that has to
allow inline script is not worth writing — script-src 'unsafe-inline' gives
back exactly the XSS foothold the policy exists to remove — so the three
inline constructs the templates still had are moved out first:

  - the layout's <style> block becomes /static/panel.css;
  - the one style="background:#b42318" attribute becomes the .danger class
    that already existed for it;
  - the four onsubmit="return confirm(...)" handlers become data-confirm,
    handled by a delegated listener in panel.js. Delegation matters: the
    application rows are also delivered by HTMX swaps.

htmx would otherwise inject a <style> of its own for the request-indicator
classes and become the single reason the policy needs an exemption; the panel
uses no hx-indicator, so the meta config switches it off.

A guard test keeps this from silently regressing later, which it otherwise
would: an inline handler added to a template does not fail, it just quietly
stops working in the browser.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/web/templates/domain_detail.html

@@ -152,18 +152,18 @@
             </form>
             {{if .HasLimit}}
             <form class="inline" method="post" action="/applications/{{.ID}}/ratelimit"
-                  onsubmit="return confirm('Remove the rate limit for {{.Login}}? Only the global level-1 limit will apply.')">
+                  data-confirm="Remove the rate limit for {{.Login}}? Only the global level-1 limit will apply.">
               <input type="hidden" name="clear" value="1">
               <button type="submit" class="danger">Remove limit</button>
             </form>
             {{end}}
           </details>
           <form class="inline" method="post" action="/applications/{{.ID}}/password"
-                onsubmit="return confirm('Regenerate the password for {{.Login}}? The current password stops working immediately.')">
+                data-confirm="Regenerate the password for {{.Login}}? The current password stops working immediately.">
             <button type="submit">New password</button>
           </form>
           <form class="inline" method="post" action="/applications/{{.ID}}/delete"
-                onsubmit="return confirm('Delete application {{.Login}}? Its credentials stop working immediately.')">
+                data-confirm="Delete application {{.Login}}? Its credentials stop working immediately.">
             <button type="submit" class="danger">Delete</button>
           </form>
         </td>
@@ -204,7 +204,7 @@
   </form>
   {{if .DomainHasRL}}
   <form class="inline" method="post" action="/domains/{{.Domain.ID}}/ratelimit"
-        onsubmit="return confirm('Remove the domain rate limit? Only the global level-1 limit will apply.')">
+        data-confirm="Remove the domain rate limit? Only the global level-1 limit will apply.">
     <input type="hidden" name="clear" value="1">
     <button type="submit" class="danger">Remove limit</button>
   </form>