Harden auth flow, CSP, and UI event handling

[Copilot]

This change implements the requested medium‑severity hardening: enforce CSRF on logout, tighten 2FA handling, remove inline handlers to allow stricter CSP, enforce production session secrets, and add login/2FA rate limits. It addresses the plan items end‑to‑end without altering core app behavior.

• Auth/session hardening
  • CSRF required for /api/auth/logout
  • SESSION_SECRET required in production
  • login + 2FA rate limiting
  • 2FA fallback logging gated behind ALLOW_2FA_LOG_FALLBACK
• CSP tightening
  • CSP nonce added for JSON‑LD scripts
  • script-src-attr 'none' to disallow inline handlers
• UI event handling
  • replaced inline on* handlers with data-action dispatch and centralized event delegation
  • removed inline history.back() handlers in static help/policy/dpia/guide pages

Example (inline handler → delegated action):

<!-- before -->
<button onclick="doLogin()">Log in</button>

<!-- after -->
<button data-action="doLogin">Log in</button>