feat: self-host HTMX 2.0.10 and Hyperscript 0.9.91, remove unpkg CDN

- Download htmx.min.js v2.0.10 and _hyperscript.min.js v0.9.91 locally
- Update head-scripts.html to load from /static/ instead of unpkg CDN
- Remove https://unpkg.com from CSP script-src whitelist
- Update all documentation references to reflect self-hosted paths
- No breaking changes: all hx-* attributes are HTMX 2.0 compatible

doc/03-API.md

@@ -988,7 +988,7 @@ isHTMX := r.Header.Get("HX-Request") != ""
       hx-push-url="/?lang=en"
       class="lang-btn">
       English
-    </button>
+    </button>
 
     <button
       hx-get="/cv?lang=es"
@@ -1669,7 +1669,7 @@ func RateLimitMiddleware(limiter *IPRateLimiter) func(http.Handler) http.Handler
         class="lang-btn active"
         hx-get="/cv?lang=en"
         hx-target="#cv-content"
-        hx-swap="innerHTML"
+        hx-swap="innerHTML"
         hx-push-url="/?lang=en"
         onclick="setActive(this)">
         English