feat: lazy load ninja-keys + HTML Invoker Commands API

- Lazy load ninja-keys only on CMD+K press (0 requests on initial load)
- Use esm.sh bundled module (3 requests vs ~81 previously)
- Add esm.sh to CSP whitelist
- Implement HTML Invoker Commands API for modals:
  - commandfor="modal-id" + command="show-modal" for opening
  - commandfor="modal-id" + command="close" for closing
  - Removes need for onclick handlers on modal buttons
- Refactor index.html into layout partials (head, body-scripts)
- Add comprehensive tests for both features

templates/partials/widgets/cmd-k-button.html

@@ -1,11 +1,11 @@
 {{define "cmd-k-button"}}
 <!-- CMD+K Command Bar Button (Fixed Left - Last) -->
+<!-- Uses lazy loading - ninja-keys loads on first click -->
 <button
     id="cmd-k-button"
-    class="fixed-btn cmd-k-btn no-print has-tooltip"
+    class="fixed-btn cmd-k-btn no-print has-tooltip cmd-k-trigger"
     aria-label="{{.UI.CmdK.Button.AriaLabel}}"
-    data-tooltip="{{.UI.CmdK.Button.Tooltip}}"
-    _="on click set #cmd-k-bar's @open to true">
+    data-tooltip="{{.UI.CmdK.Button.Tooltip}}">
     <iconify-icon icon="mdi:text-box-search-outline"></iconify-icon>
 </button>
 {{end}}