The production CSP is `script-src 'self'` (no 'unsafe-inline'), so every
inline <script> / on*= handler was silently dead in prod (worked in dev,
which adds 'unsafe-inline'). Move that logic to app.js and HTMX.
- Logs pop-out did nothing: the modal's inline showModal()/onclick/onclose
were CSP-blocked. app.js now opens the dialog on htmx:afterSwap to
#modal-root (backdrop-close, clear-on-close, autoscroll).
- Device logs showed fabricated lines: the SSE handler now emits one
honest "not implemented yet" notice instead of fake logs.
- Sidebar doubled when opening a device from the dashboard: the attention
rows swapped a full page into `closest main`; now target `body` like the
list.
- Both list action buttons just opened the device (their onclick
stopPropagation was CSP-blocked): removed the redundant no-op/quick-log
buttons + the unused checkbox column; rows simply navigate. Filter
dropdowns used onchange — switched to hx-trigger="change".
- Deployment Overview tab loaded the home page; switching tabs left the
highlight on Overview: the handler returned the full page for
?tab=overview, and only the content swapped. Tabs now re-render as a
unit (bar + content) so overview returns content and the active
highlight follows. Same fix applied to device-detail tabs.
- Removed the dead Reconcile/Pause/Rollback/Roll-out buttons; replaced the
fabricated deployment "manifest" with the real fields we have.
