panel: move inline styles and confirmations out of the templates

Groundwork for the Content-Security-Policy of phase 14.A. A policy that has to
allow inline script is not worth writing — script-src 'unsafe-inline' gives
back exactly the XSS foothold the policy exists to remove — so the three
inline constructs the templates still had are moved out first:

  - the layout's <style> block becomes /static/panel.css;
  - the one style="background:#b42318" attribute becomes the .danger class
    that already existed for it;
  - the four onsubmit="return confirm(...)" handlers become data-confirm,
    handled by a delegated listener in panel.js. Delegation matters: the
    application rows are also delivered by HTMX swaps.

htmx would otherwise inject a <style> of its own for the request-indicator
classes and become the single reason the policy needs an exemption; the panel
uses no hx-indicator, so the meta config switches it off.

A guard test keeps this from silently regressing later, which it otherwise
would: an inline handler added to a template does not fail, it just quietly
stops working in the browser.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/web/static/panel.js

@@ -32,6 +32,20 @@
     });
   });
 
+  // --- Confirmation on destructive forms --------------------------------
+  // Forms that delete something or invalidate a working credential carry a
+  // data-confirm message. The prompt lives here rather than in an inline
+  // onsubmit attribute because the panel's Content-Security-Policy allows no
+  // inline script (phase 14.A). The listener is delegated from the document,
+  // so it also covers markup swapped in by HTMX. With JavaScript disabled the
+  // form submits without asking — exactly as the inline handler behaved.
+  document.addEventListener("submit", function (ev) {
+    var form = ev.target.closest("form[data-confirm]");
+    if (form && !window.confirm(form.dataset.confirm)) {
+      ev.preventDefault();
+    }
+  });
+
   // --- Address list shown only in list mode -----------------------------
   // The "Addresses" field applies to list mode only; in wildcard mode the
   // server ignores it, so hiding it removes a field that does nothing. The