fix(web): complete the CSP-build migration across remaining surfaces

- audio reader: scrub/volume/speed/genre-tick bindings converted to
  component methods (onScrubInput, setVolumeFromEvent,
  applyDefaultSpeedFromSelect, volumeLabel, railTickStyle,
  isSkipActive/isSpeedActive) — these used Number/Math/String globals
  that the CSP evaluator cannot resolve
- fmtTime restored to the audioReader component: the unexport pass
  had ripped it from the Alpine.data object (time displays were dead)
- book detail: cover-upload click and banner edit validation moved to
  component methods (triggerCoverUpload, bannerEditHasText)
- admin/docs/index components: init() hooks for their x-init chains
- CSP header: 'unsafe-eval' dropped — the CSP build needs no eval
- e2e spec: replace test.info().annotate (unavailable in this
  Playwright version) with console logging

templates/book_detail_modals.templ

@@ -275,7 +275,7 @@ templ MetadataEditorModal(book handlers.MediaDetail) {
 				<div class="flex-shrink-0">
 					<div class="w-64 h-96 rounded-xl overflow-hidden mb-3 cursor-pointer relative group"
 						style="background-color: var(--bg-primary);"
-						@click="document.getElementById('cover-upload-input').click()"
+						@click="triggerCoverUpload()"
 					>
 						if book.CoverImagePath.Valid && book.CoverImagePath.String != "" {
 							<img id="metadata-cover-preview"