Fix remaining frontend security issues (3 medium, 2 low)

- Escape user-input port number in app-selector innerHTML
- Replace inline onclick with addEventListener in backup history (HTML entity decode bypass)
- Add Content-Security-Policy meta tag with script hash
- Replace document.write with textContent for footer year
- Filter __proto__/constructor/prototype in Object.assign calls

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

status/js/backup-restore.js

@@ -381,7 +381,7 @@
             <span style="font-weight: 500;">${escapeHtml(bk.name || 'backup')}</span>
             <div style="display: flex; align-items: center; gap: 8px;">
               <span class="status-badge ${bk.status === 'success' ? 'success' : 'down'}">${escapeHtml(bk.status)}</span>
-              ${bk.status === 'success' ? `<button onclick="window.__restoreServerBackup('${escapeHtml(bk.id)}')" style="padding: 3px 8px; font-size: 0.75rem;">Restore</button>` : ''}
+              ${bk.status === 'success' ? `<button class="backup-restore-btn" data-backup-id="${escapeHtml(bk.id)}" style="padding: 3px 8px; font-size: 0.75rem;">Restore</button>` : ''}
             </div>
           </div>
           <div style="font-size: 0.75rem; color: var(--muted);">
@@ -392,6 +392,10 @@
       }
       html += '</div>';
       historyContainer.innerHTML = html;
+      // Wire restore buttons with addEventListener (not inline onclick — HTML entity decode bypass)
+      historyContainer.querySelectorAll('.backup-restore-btn').forEach(btn => {
+        btn.addEventListener('click', () => window.__restoreServerBackup(btn.dataset.backupId));
+      });
     } catch (e) {
       historyContainer.innerHTML = `<div class="panel-empty" style="color: var(--bad-fg);">Failed: ${escapeHtml(e.message)}</div>`;
     }