fix(auth): login/registration forms redirect again under hash CSP

The htmx login/registration partials answered success with an inline
<script> that stashed the auth token and set window.location — refused
by hash-mode script-src (no 'unsafe-inline'), so the user saw "Login
successful! Redirecting..." and nothing else (reported from the home-
page login form; /login was equally broken). The same pattern lived in
collections.go (delete → redirect) and devices.go (token regen →
reload, whose script tag was also unclosed).

Replacement, per the AGENTS.md CSP rules:
- auth.go login/registration: the partial now carries data-auth-token +
  data-redirect (redirect is path-only — open-redirect hygiene — and
  escaped); web/src/auth_forms.ts (new, armed from main.ts on every
  page) listens for htmx:afterSwap, stashes the token, and navigates.
- collections.go delete: data-redirect, same listener.
- devices.go token regen: htmx's native HX-Refresh response header.
- The dead localStorage 'user'/'refreshToken' writes are dropped — no
  reader anywhere in web/src; only 'token' is load-bearing (19 modules).

Tripwire extension: internal/middleware/csp_go_sources_test.go scans
non-test Go sources for literal <script> tags and native on*= attributes
(hand-written files only — templ codegen is owned by the .templ scan),
verified to fire on a reintroduced probe. AGENTS.md CSP section notes
the Go-emitted-partial vector.

Verified live: home-page login form → /dashboard with token stashed and
dashboard loading clean; /register form → /dashboard; collections and
devices share the same mechanisms (data-redirect / HX-Refresh). Gates:
make test (9 pkgs incl. both tripwires), vitest 155, Playwright 20,
tsc/vp clean.

internal/handlers/auth.go

@@ -10,6 +10,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"html"
 	"html/template"
 	"math"
 	"net/http"
@@ -335,13 +336,9 @@ func (h *AuthHandler) Register(c *echo.Context) error {
 	}
 
 	if c.Request().Header.Get("HX-Request") == "true" {
-		html := fmt.Sprintf(`<div class="text-green-500">Registration successful! Redirecting...</div>
-<script>
-localStorage.setItem('token', '%s');
-localStorage.setItem('refreshToken', '%s');
-localStorage.setItem('user', JSON.stringify(%s));
-window.location.href = '/dashboard';
-</script>`, accessToken, refreshToken, fmt.Sprintf(`{"id":"%s","email":"%s","username":"%s"}`, uuid.UUID(user.ID.Bytes).String(), user.Email, user.Username))
+		// CSP: see the login handler — data attributes, not inline scripts.
+		html := fmt.Sprintf(`<div class="text-green-500" data-auth-token="%s" data-redirect="/dashboard">Registration successful! Redirecting...</div>`,
+			accessToken)
 		return c.HTML(http.StatusCreated, html)
 	}
 
@@ -481,17 +478,18 @@ func (h *AuthHandler) Login(c *echo.Context) error {
 	}
 
 	if c.Request().Header.Get("HX-Request") == "true" {
+		// CSP: hash-mode script-src refuses inline scripts, so the htmx
+		// partial carries data attributes instead; web/src/auth_forms.ts
+		// stashes the token and navigates on htmx:afterSwap. The redirect
+		// target is path-only (open-redirect hygiene) and the old
+		// 'user'/'refreshToken' localStorage writes are gone — nothing
+		// ever read them.
 		redirect := c.FormValue("redirect")
-		if redirect == "" {
+		if redirect == "" || !strings.HasPrefix(redirect, "/") {
 			redirect = "/dashboard"
 		}
-		html := fmt.Sprintf(`<div class="text-green-500">Login successful! Redirecting...</div>
-<script>
-localStorage.setItem('token', '%s');
-localStorage.setItem('refreshToken', '%s');
-localStorage.setItem('user', JSON.stringify(%s));
-window.location.href = '%s';
-</script>`, accessToken, refreshToken, fmt.Sprintf(`{"id":"%s","email":"%s","username":"%s","first_name":"%s","last_name":"%s"}`, uuid.UUID(user.ID.Bytes).String(), user.Email, user.Username, user.FirstName.String, user.LastName.String), redirect)
+		html := fmt.Sprintf(`<div class="text-green-500" data-auth-token="%s" data-redirect="%s">Login successful! Redirecting...</div>`,
+			accessToken, html.EscapeString(redirect))
 		return c.HTML(http.StatusOK, html)
 	}