security(relay): fix lockout DoS and DOM XSS in web client

Addresses two Major findings from PR review:

- Auth lockout no longer griefable: the throttle key is namespaced per path
  and includes the client IP (web:<session>:<ip> vs desktop:<session>:<ip>),
  so a flood of bad web-client auths can neither lock other clients of the
  same session nor block the desktop from (re)authenticating. Per-socket
  failure close and brute-force lockout are preserved.
- Relay web client XSS eliminated: app.html tab/macro rendering rebuilt with
  createElement/textContent (no macro/tab value reaches innerHTML); inline
  scripts/handlers externalized to /static/app.js and /static/login.js so the
  helmet CSP now uses script-src 'self' (dropped 'unsafe-inline' for scripts).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

macropad-relay/src/handlers/desktopHandler.ts

@@ -37,7 +37,8 @@ type DesktopMessage = AuthMessage | ApiResponseMessage | WsBroadcastMessage | Po
 export function handleDesktopConnection(
   socket: WebSocket,
   connectionManager: ConnectionManager,
-  sessionManager: SessionManager
+  sessionManager: SessionManager,
+  clientIp: string
 ): void {
   let authenticatedSessionId: string | null = null;
   // Track failed auth attempts on this individual socket.
@@ -49,7 +50,7 @@ export function handleDesktopConnection(
 
       switch (message.type) {
         case 'auth': {
-          const failed = await handleAuth(socket, message, sessionManager, connectionManager, (sessionId) => {
+          const failed = await handleAuth(socket, message, sessionManager, connectionManager, clientIp, (sessionId) => {
             authenticatedSessionId = sessionId;
           });
           if (failed) {
@@ -110,6 +111,7 @@ async function handleAuth(
   message: AuthMessage,
   sessionManager: SessionManager,
   connectionManager: ConnectionManager,
+  clientIp: string,
   setSessionId: (id: string) => void
 ): Promise<boolean> {
   try {
@@ -117,8 +119,14 @@ async function handleAuth(
     let session;
 
     if (sessionId) {
-      // Reject early if this session id is currently locked out.
-      const lockRemaining = getLockoutRemaining(sessionId);
+      // Namespace the brute-force lockout key to the desktop keyspace and
+      // include the client IP. This keeps the desktop's lockout state entirely
+      // separate from the web-client keyspace, so a web-auth flood can never
+      // lock the desktop out of (re)authenticating.
+      const throttleKey = `desktop:${sessionId}:${clientIp}`;
+
+      // Reject early if this key is currently locked out.
+      const lockRemaining = getLockoutRemaining(throttleKey);
       if (lockRemaining > 0) {
         socket.send(JSON.stringify({
           type: 'auth_response',
@@ -132,7 +140,7 @@ async function handleAuth(
       // Validate existing session
       const valid = await sessionManager.validatePassword(sessionId, message.password);
       if (!valid) {
-        recordFailure(sessionId);
+        recordFailure(throttleKey);
         socket.send(JSON.stringify({
           type: 'auth_response',
           success: false,
@@ -140,7 +148,7 @@ async function handleAuth(
         }));
         return true;
       }
-      recordSuccess(sessionId);
+      recordSuccess(throttleKey);
       session = sessionManager.getSession(sessionId);
     } else {
       // Create new session (may throw on limit / short password)