feat: self-host HTMX 2.0.10 and Hyperscript 0.9.91, remove unpkg CDN

- Download htmx.min.js v2.0.10 and _hyperscript.min.js v0.9.91 locally
- Update head-scripts.html to load from /static/ instead of unpkg CDN
- Remove https://unpkg.com from CSP script-src whitelist
- Update all documentation references to reflect self-hosted paths
- No breaking changes: all hx-* attributes are HTMX 2.0 compatible

templates/partials/layout/head-scripts.html

@@ -2,10 +2,8 @@
     <!-- Device Detection - Detect real mobile devices vs desktop browser -->
     <script src="/static/js/device-detection.js"></script>
 
-    <!-- HTMX with SRI (Subresource Integrity) -->
-    <script src="https://unpkg.com/htmx.org@1.9.10"
-            integrity="sha384-D1Kt99CQMDuVetoL1lrYwg5t+9QdHe7NLX/SoJYkXDFfX37iInKRy5xLSi8nO7UC"
-            crossorigin="anonymous"></script>
+    <!-- HTMX 2.0.10 (self-hosted) -->
+    <script src="/static/htmx/htmx.min.js"></script>
 
     <!-- Hyperscript Functions - Must load BEFORE hyperscript library -->
     <!-- NOTE: cv-functions.js removed - hyperscript def statements are globally available -->
@@ -23,12 +21,12 @@
     <!-- NOTE: footer-buttons-interaction.js removed - moved to hyperscript on footer element -->
     <!-- NOTE: scroll-at-bottom-handler.js removed - duplicate of handleScroll() in utils._hs -->
 
-    <!-- Hyperscript - Declarative event handling for enhanced interactivity -->
-    <script src="https://unpkg.com/hyperscript.org@0.9.14"></script>
+    <!-- Hyperscript 0.9.91 (self-hosted) -->
+    <script src="/static/hyperscript/_hyperscript.min.js"></script>
 
     <!-- Ninja Keys - Lazy loaded on CMD+K (see body-scripts for loader) -->
 
     <!-- Iconify - Load synchronously for immediate rendering -->
-    <!-- Using unpkg CDN (more reliable than code.iconify.design) -->
+    <!-- Using jsdelivr CDN (more reliable than code.iconify.design) -->
     <script src="https://cdn.jsdelivr.net/npm/iconify-icon@2.1.0/dist/iconify-icon.min.js"></script>
 {{end}}