feat: Priority 3 — CSP, SRI hash for Chart.js, Dependabot

[Copilot]

Implements all three Priority 3 security hardening items from the roadmap.

Changes

• CSP meta tag — adds Content-Security-Policy to index.html:

  • script-src 'self' https://cdn.jsdelivr.net — blocks rogue script injection
  • style-src 'self' 'unsafe-inline' https://fonts.googleapis.com — 'unsafe-inline' required; site uses inline style="" attributes extensively in both HTML and JS-injected innerHTML
  • font-src, img-src, object-src 'none', base-uri 'self', form-action 'none' locked down

• Chart.js SRI — switches from chart.umd.min.js (CDN-generated, not in the npm package — no offline-verifiable hash) to the canonical chart.umd.js from the npm tarball, with a verified SHA-384 integrity attribute:

  <script src="https://cdn.jsdelivr.net/npm/chart.js@4.4.0/dist/chart.umd.js"
          integrity="sha384-FcQlsUOd0TJjROrBxhJdUhXTUgNJQxTMcxZe6nHbaEfFL1zjQ+bq/uRoBQxb0KMo"
          crossorigin="anonymous"></script>

• Dependabot — adds .github/dependabot.yml with weekly schedules for both npm and github-actions ecosystems