refactor: extract inline CSS/JS from views into separate asset files (20+ files)

Phase A — HTML removed from PHP files:
- RateLimitMiddleware.php: heredoc moved to views/errors/429.php
- public/index.php: inline HTML replaced with View::error()
- AuthMiddleware.php: <script> redirect replaced with <meta refresh>

Phase B — Inline CSS/JS extracted from views:
- CSS: landing.css (459 lines), legal.css (shared by terms+privacy)
- JS: 17 new files extracted from ~20 view files
  - main.js (layout sidebar + notifications)
  - dashboard-chart.js, server-show.js, server-services.js
  - nginx-manager.js, database-manager.js
  - terminal.js, team-show.js, team-index.js
  - server-list.js, server-permissions.js (shared by edit+create)
  - server-ssl.js, server-processes.js, system-users.js
  - admin-users.js, audit-log.js, admin-notifications.js, admin-security.js
  - notifications.js

Total: -3264 lines from views, +288 lines in new assets

views/admin/security.php

@@ -102,22 +102,4 @@
     </div>
 </div>
 
-<script>
-function generateKey() {
-    if (!confirm('WARNING: Generating a new master key will make all existing encrypted credentials UNREADABLE. ' +
-                 'You will need to re-enter all SSH credentials. Continue?')) return;
-
-    fetch('/admin/security/generate-key', {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/x-www-form-urlencoded',
-            'X-CSRF-Token': document.querySelector('meta[name="csrf-token"]')?.content || '',
-        },
-        body: '_csrf_token=' + encodeURIComponent(document.querySelector('meta[name="csrf-token"]')?.content || ''),
-    })
-    .then(r => r.json())
-    .then(data => {
-        showToast(data.success ? 'success' : 'error', data.message);
-    });
-}
-</script>
+<script src="/assets/js/admin-security.js"></script>