CSP: replace 'unsafe-inline' with a content hash for the theme flash guard

script-src now allow-lists the guard by sha256 of its rendered bytes
(middleware.ScriptHashThemeFlashGuard) instead of 'unsafe-inline' — the
guard is the app's only inline <script>. security_headers_test.go renders
templates.ThemeFlashGuard() and fails with the replacement hash if the
script text ever drifts.

Executing anti-XSS strict CSP surfaced three latent violations the
eval-removal sweep couldn't see (hash mode is stricter than eval mode,
because inline event handler ATTRIBUTES now count against script-src):

1. admin_archived / admin_library: 15 native onclick=/onsubmit= handlers
   (modal open/close, folder-browser picker, purge button) converted to
   Alpine @click/@submit component methods — openCreateLibraryModal,
   hideModal, pickBrowsePath added to the admin component;
   purgeArchivedItems promoted from its window global into the component
   and the (window as any) exposure removed.

2. dashboard/docs: onclick handlers converted — dashboard's
   event.stopPropagation() → @click.stop; docs' sidebar/search closers →
   closeDocsSidebar/closeSearchResults component methods.

3. 8 onerror= image-fallback attributes (cover placeholders app-wide +
   audiobook cover hide) replaced by data-fallback attributes handled by
   one delegated capture-phase listener in web/src/image_fallback.ts —
   works for htmx-swapped content without re-binding.

Verified: theme guard applies a saved theme on public pages under the
hash CSP; 14-page authenticated sweep clean; admin pages clean under the
promoted admin; admin-library modal open/close bindings exercised;
readers render error-free; go build/vet/middleware-test, tsc, vp
check/test (146), build:ts all green.

web/src/admin.ts

@@ -427,8 +427,6 @@ async function purgeArchivedItems(): Promise<void> {
   }
 }
 
-(window as any).purgeArchivedItems = purgeArchivedItems;
-
 // Restore a hidden/archived item to library visibility without waiting for
 // its file to return (POST /api/media-items/:id/unarchive). If the file is
 // still gone the next scan hides it again.
@@ -599,6 +597,21 @@ Alpine.data("admin", () => ({
     this.loadWatchStatus();
     this.checkActiveScans();
   },
+  purgeArchivedItems,
+  openCreateLibraryModal() {
+    document.getElementById("create-library-modal")?.classList.remove("hidden");
+  },
+  hideModal(id: string) {
+    document.getElementById(id)?.classList.add("hidden");
+  },
+  pickBrowsePath(e: Event) {
+    const button = e.currentTarget as HTMLElement;
+    const input = document.getElementById(
+      button.dataset.targetInput ?? "",
+    ) as HTMLInputElement | null;
+    if (input) input.value = button.dataset.currentPath ?? "";
+    this.hideModal("folder-browser-modal");
+  },
   cancelAllScans,
   checkActiveScans,
   hideScanProgress,

web/src/docs.ts

@@ -158,6 +158,13 @@ Alpine.data("docs", () => ({
     this.initializeSearch();
     this.initializeCodeCopyButtons();
   },
+  closeDocsSidebar(e: Event) {
+    document.getElementById("docs-sidebar")?.classList.add("-translate-x-full");
+    (e.currentTarget as HTMLElement).classList.add("hidden");
+  },
+  closeSearchResults(e: Event) {
+    (e.currentTarget as HTMLElement).closest("#docs-search-results")?.classList.add("hidden");
+  },
   toggleSidebar,
   toggleCollapsible,
   initializeSearch: initializeDocsSearch,

web/src/image_fallback.ts

@@ -0,0 +1,38 @@
+// Delegated image-fallback handling for strict CSP.
+//
+// Cover images used to carry inline `onerror` attributes; under the
+// hash-allow-listed script-src (no 'unsafe-inline') the browser refuses to
+// execute them. This module restores the same behavior with one
+// capture-phase listener on <html>, so htmx-swapped containers are covered
+// without any per-element re-binding.
+//
+// Opt-ins via data attributes on the element:
+//   data-fallback="hide"  → hide the element instead of swapping the src
+//                           (audiobook covers: placeholder would overflow)
+//   default               → swap a broken cover to the placeholder SVG
+
+const PLACEHOLDER = "/static/placeholder-book.svg";
+
+let armed = false;
+
+function onResourceError(event: Event) {
+  const target = event.target;
+  // Only interested in resource elements (img/audio/video/source), not
+  // generic events bubbling up (error does not bubble, but capture sees it).
+  if (!(target instanceof HTMLImageElement)) return;
+
+  if (target.dataset.fallback === "hide") {
+    target.style.display = "none";
+    return;
+  }
+  // Never chase our own placeholder (if it 404s, stop).
+  if (target.src.endsWith(PLACEHOLDER)) return;
+  target.src = PLACEHOLDER;
+}
+
+export function armImageFallbacks() {
+  if (armed) return;
+  armed = true;
+  // Capture is required: 'error' doesn't bubble.
+  document.documentElement.addEventListener("error", onResourceError, true);
+}

web/src/main.ts

@@ -17,6 +17,7 @@ import "./device-management";
 import "./docs";
 import "./header";
 import "./index";
+import "./image_fallback";
 import "./library-switcher";
 import "./linking";
 import "./login";