fix(viewer): externalize inline search script blocked by CSP

[lizhengfeng101]

Description

The viewer's repository search functionality is broken. PR #735 introduced a strict Content-Security-Policy header with script-src 'self', which correctly blocks inline scripts. However, the repository list page (repos.html) still uses an inline <script> block for its search/filter feature, causing the browser to refuse execution.

The session page's script was already externalized to static/session.js as part of #735, but the repos page script was missed.

Current behavior in internal/viewer/templates/repos.html (lines 31–47):

<script>
(() => {
    const input = document.getElementById("repository-search-input");
    const table = document.getElementById("repositories-table");
    if (!input || !table) return;

    const rows = table.querySelectorAll("tbody tr");
    input.addEventListener("input", () => {
        const query = input.value.trim().toLowerCase();
        rows.forEach((row) => {
            const nameCell = row.querySelector("[data-repository-name]");
            const name = nameCell ? nameCell.textContent.trim().toLowerCase() : "";
            row.hidden = !name.includes(query);
        });
    });
})();
</script>

This inline script is blocked by the CSP defined in internal/viewer/securityheaders.go:

const contentSecurityPolicy = "default-src 'self'; " +
    "script-src 'self'; " +
    ...

Scope

• File(s): internal/viewer/templates/repos.html, new file internal/viewer/static/repos.js
• Area: Viewer frontend / CSP compliance

Acceptance Criteria

• Move the inline script from repos.html into a new internal/viewer/static/repos.js file
• Replace the inline <script> block with <script src="/static/repos.js"></script>
• Repository search/filter works in the browser with CSP active
• Tests pass (make test)
• Code check passes (make check)

Context

Discovered while testing PR #738 (collapsible sections). The CSP headers from #735 (commit d1008b8) are working as intended — the fix is to externalize the remaining inline script, not to weaken the policy.