refactor: extract inline CSS/JS from views into separate asset files (20+ files)

Phase A — HTML removed from PHP files:
- RateLimitMiddleware.php: heredoc moved to views/errors/429.php
- public/index.php: inline HTML replaced with View::error()
- AuthMiddleware.php: <script> redirect replaced with <meta refresh>

Phase B — Inline CSS/JS extracted from views:
- CSS: landing.css (459 lines), legal.css (shared by terms+privacy)
- JS: 17 new files extracted from ~20 view files
  - main.js (layout sidebar + notifications)
  - dashboard-chart.js, server-show.js, server-services.js
  - nginx-manager.js, database-manager.js
  - terminal.js, team-show.js, team-index.js
  - server-list.js, server-permissions.js (shared by edit+create)
  - server-ssl.js, server-processes.js, system-users.js
  - admin-users.js, audit-log.js, admin-notifications.js, admin-security.js
  - notifications.js

Total: -3264 lines from views, +288 lines in new assets

views/servers/processes.php

@@ -101,66 +101,6 @@ $processList = $processList ?? [];
 </div>
 
 <script>
-let pendingPid = null;
-let pendingBtn = null;
-
-function getCsrfToken() {
-    return document.querySelector('meta[name="csrf-token"]')?.content || '';
-}
-
-function killProcess(pid, btn) {
-    pendingPid = pid;
-    pendingBtn = btn;
-    document.getElementById('killPidDisplay').textContent = pid;
-    document.getElementById('killModal').style.display = 'flex';
-}
-
-function closeKillModal() {
-    pendingPid = null;
-    pendingBtn = null;
-    document.getElementById('killForce').checked = false;
-    document.getElementById('killModal').style.display = 'none';
-}
-
-function confirmKill() {
-    if (!pendingPid) return;
-
-    const signal = document.getElementById('killForce').checked ? 9 : 15;
-    const btn = document.getElementById('confirmKillBtn');
-    const originalText = btn.innerHTML;
-    btn.disabled = true;
-    btn.innerHTML = '<i class="fas fa-spinner fa-spin"></i> Killing...';
-
-    fetch('/servers/<?= $server['id'] ?>/processes/kill', {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/x-www-form-urlencoded',
-            'X-CSRF-Token': getCsrfToken(),
-        },
-        body: 'pid=' + pendingPid + '&signal=' + signal + '&_csrf_token=' + encodeURIComponent(getCsrfToken()),
-    })
-    .then(r => r.json())
-    .then(data => {
-        showToast(data.success ? 'success' : 'error', data.message);
-        if (data.success && pendingBtn) {
-            const row = pendingBtn.closest('tr');
-            row.style.opacity = '0.4';
-            pendingBtn.disabled = true;
-            pendingBtn.innerHTML = '<i class="fas fa-check"></i> Killed';
-        }
-        closeKillModal();
-    })
-    .catch(err => {
-        showToast('error', 'Request failed: ' + err.message);
-        closeKillModal();
-    })
-    .finally(() => {
-        btn.disabled = false;
-        btn.innerHTML = originalText;
-    });
-}
-
-document.addEventListener('keydown', function(e) {
-    if (e.key === 'Escape') closeKillModal();
-});
+const serverId = <?= $server['id'] ?>;
 </script>
+<script src="/assets/js/server-processes.js"></script>