Fix remaining frontend security issues (3 medium, 2 low)

- Escape user-input port number in app-selector innerHTML
- Replace inline onclick with addEventListener in backup history (HTML entity decode bypass)
- Add Content-Security-Policy meta tag with script hash
- Replace document.write with textContent for footer year
- Filter __proto__/constructor/prototype in Object.assign calls

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

status/js/app-selector.js

@@ -587,7 +587,7 @@
 
       const result = await checkPortAvailability(portToCheck);
       if (result.available) {
-        portStatus.innerHTML = `<span style="color: #4caf50;">Port ${portToCheck} is available</span>`;
+        portStatus.innerHTML = `<span style="color: #4caf50;">Port ${escapeHtml(String(portToCheck))} is available</span>`;
       } else {
         const suggestedPort = await getSuggestedPort(defaultPort);
         portStatus.innerHTML = `