feat: lazy load ninja-keys + HTML Invoker Commands API

- Lazy load ninja-keys only on CMD+K press (0 requests on initial load)
- Use esm.sh bundled module (3 requests vs ~81 previously)
- Add esm.sh to CSP whitelist
- Implement HTML Invoker Commands API for modals:
  - commandfor="modal-id" + command="show-modal" for opening
  - commandfor="modal-id" + command="close" for closing
  - Removes need for onclick handlers on modal buttons
- Refactor index.html into layout partials (head, body-scripts)
- Add comprehensive tests for both features

templates/partials/widgets/shortcuts-button.html

@@ -1,9 +1,11 @@
 {{define "shortcuts-button"}}
 <!-- Keyboard Shortcuts Button (Fixed Left) -->
+<!-- Uses HTML Invoker Commands API: commandfor + command="show-modal" -->
 <button
     id="shortcuts-button"
     class="fixed-btn shortcuts-btn no-print has-tooltip"
-    onclick="document.getElementById('shortcuts-modal').showModal()"
+    commandfor="shortcuts-modal"
+    command="show-modal"
     aria-label="{{.UI.Widgets.Shortcuts.AriaLabel}}"
     data-tooltip="{{.UI.Widgets.Shortcuts.Tooltip}}">
     <iconify-icon icon="mdi:keyboard-outline"></iconify-icon>