refactor(ui): WebUI modernization PR5 — ES module split

Split the ~2.4k-line app.js IIFE into native ES modules under
cmd/odek/ui/js/ (no build step, no dependencies). app.js stays the
/app.js entry and now just imports ./js/main.js.

- js/state.js: single mutable state object S (all former module-level
  globals) + session-token persistence helpers
- js/dom.js / js/net.js: import-free leaves (getElementById refs,
  getWsToken/apiHeaders)
- js/utils.js / js/markdown.js: pure helpers and markdownToHtml
- js/render.js: streaming, thinking, tool blocks, sub-agents, session
  history, collapse/copy, loading indicator; addMessage monkey-patch
  dissolved into direct addCopyButton/checkCollapse calls
- js/approvals.js / js/sessions.js / js/input.js / js/ws.js / js/main.js:
  approval queue, sidebar, prompt/attachments/@-completion, WebSocket
  dispatch, init sequence
- All inline onclick/onchange handlers (index.html and generated HTML)
  replaced with addEventListener / click delegation on #messages;
  window.* exports removed
- serve.go handleStatic: sanitized /js/<file>.js route (rejects ..,
  subdirs, non-.js) served from the embedded uiFS

Author: jkyberneees

cmd/odek/serve.go

@@ -1762,6 +1762,17 @@ func handleStatic(wsToken string) http.HandlerFunc {
 			return
 		}
 		entry, ok := staticFiles[r.URL.Path]
+		if !ok && strings.HasPrefix(r.URL.Path, "/js/") {
+			// ES modules under /js/ are served from the embedded ui/js
+			// directory. Sanitize to a flat .js file name so path traversal
+			// is impossible.
+			name := strings.TrimPrefix(r.URL.Path, "/js/")
+			if name != "" && !strings.Contains(name, "..") &&
+				!strings.ContainsAny(name, "/\\") && strings.HasSuffix(name, ".js") {
+				entry = [2]string{"ui/js/" + name, "application/javascript; charset=utf-8"}
+				ok = true
+			}
+		}
 		if !ok {
 			http.NotFound(w, r)
 			return