Fix CSP-blocked inline onclick handlers

- Remove onclick from API key recovery modal Copy button (templates/pages/index.html)
- Event listener already exists in app.js (line 295)
- Remove onclick from server-rendered API key display (src/index.ts line 207)
- Remove onclick from billing success page Copy button (src/routes/billing.ts line 181)
- Create public/copy-helper.js to handle all [data-copy] elements via external JS
- All copy functionality now CSP-compliant (script-src 'self')

src/index.ts

@@ -204,10 +204,12 @@ p{color:#7a8194;margin-bottom:24px;line-height:1.6}
 <p>${message}</p>
 ${apiKey ? `
 <div class="warning">⚠️ Save your API key securely. You can recover it via email if needed.</div>
-<div class="key-box" onclick="navigator.clipboard.writeText('${apiKey}');this.style.borderColor='#5eead4';setTimeout(()=>this.style.borderColor='#34d399',1500)">${apiKey}</div>
+<div class="key-box" data-copy="${apiKey}">${apiKey}</div>
 <div class="links">Upgrade to Pro for 5,000 PDFs/month · <a href="/docs">Read the docs →</a></div>
 ` : `<div class="links"><a href="/">← Back to DocFast</a></div>`}
-</div></body></html>`;
+</div>
+<script src="/copy-helper.js"></script>
+</body></html>`;
 }
 
 // Landing page