refactor: Extract settings.html inline script + JSON data blocks

Two CSP-relevant changes here:

1. Move the settingsPage() Alpine factory + flash animation logic out
   of the inline <script> block in settings.html into static/settings.js.

2. Replace the two <script type="application/json"> blocks (which CSP
   blocks under script-src even though they aren't executable) with
   data-config / data-overrides attributes on a hidden
   #settings-init-data div. Same Jinja autoescape, just an HTML
   attribute instead of a script tag, so script-src doesn't apply.

settings.js reads the data attrs at factory-call time and parses with
JSON.parse, returning the populated state object so Alpine's initial
binding evaluation has the data it needs (avoids null-deref on
x-model="config.general.test_run" before init).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: lolimmlost

src/web/static/settings.js

@@ -0,0 +1,67 @@
+// Alpine factory for the settings page. Initial state (current config + which
+// keys are overridden) is rendered server-side into data-* attributes on a
+// hidden #settings-init-data element so this script can stay CSP-clean —
+// no inline JSON, no inline scripts, no eval beyond Alpine's own expression
+// evaluator.
+function settingsPage() {
+    const dataEl = document.getElementById('settings-init-data');
+    return {
+        config: JSON.parse(dataEl.dataset.config),
+        overrides: JSON.parse(dataEl.dataset.overrides),
+        message: '',
+        messageError: false,
+        init() {},
+        isOverridden(key) {
+            return key in this.overrides;
+        },
+        async saveGeneral(attr, value, event) {
+            await this.saveOverride(`general.${attr}`, value, event);
+        },
+        async saveJob(jobName, attr, value, event) {
+            await this.saveOverride(`jobs.${jobName}.${attr}`, value, event);
+        },
+        flashEl(event, cls) {
+            if (!event) return;
+            const el = event.target.closest('label') || event.target;
+            el.classList.remove('flash-save', 'flash-error');
+            void el.offsetWidth;
+            el.classList.add(cls);
+            el.addEventListener('animationend', () => el.classList.remove(cls), { once: true });
+        },
+        async saveOverride(key, value, event) {
+            try {
+                const res = await fetch(rootPath + '/api/config', {
+                    method: 'PATCH',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({ updates: { [key]: value } }),
+                });
+                if (res.ok) {
+                    this.overrides[key] = value;
+                    this.flashEl(event, 'flash-save');
+                } else {
+                    this.flashEl(event, 'flash-error');
+                }
+            } catch {
+                this.flashEl(event, 'flash-error');
+            }
+        },
+        async resetOverrides() {
+            if (!confirm('Reset all runtime overrides to YAML defaults? This will reload settings from config file.')) return;
+            try {
+                const res = await fetch(rootPath + '/api/config/reload', { method: 'POST' });
+                if (res.ok) {
+                    this.overrides = {};
+                    this.showMessage('Reset to defaults');
+                    setTimeout(() => location.reload(), 500);
+                }
+            } catch {
+                this.showMessage('Error resetting', true);
+            }
+        },
+        showMessage(msg, error = false) {
+            this.message = msg;
+            this.messageError = error;
+            setTimeout(() => this.message = '', 3000);
+        },
+    };
+}

src/web/templates/settings.html

@@ -1,6 +1,10 @@
 {% extends "base.html" %}
 {% block title %}Settings - Decluttarr{% endblock %}
 {% block content %}
+<div id="settings-init-data"
+     data-config="{{ config | tojson }}"
+     data-overrides="{{ overrides | tojson }}"
+     hidden></div>
 <div x-data="settingsPage()" x-init="init()">
     <h2>Settings</h2>
 
@@ -136,69 +140,5 @@ <h2>Settings</h2>
 {% endblock %}
 
 {% block scripts %}
-<script type="application/json" id="init-config">{{ config | tojson }}</script>
-<script type="application/json" id="init-overrides">{{ overrides | tojson }}</script>
-<script>
-function settingsPage() {
-    return {
-        config: JSON.parse(document.getElementById('init-config').textContent),
-        overrides: JSON.parse(document.getElementById('init-overrides').textContent),
-        message: '',
-        messageError: false,
-        init() {},
-        isOverridden(key) {
-            return key in this.overrides;
-        },
-        async saveGeneral(attr, value, event) {
-            await this.saveOverride(`general.${attr}`, value, event);
-        },
-        async saveJob(jobName, attr, value, event) {
-            await this.saveOverride(`jobs.${jobName}.${attr}`, value, event);
-        },
-        flashEl(event, cls) {
-            if (!event) return;
-            const el = event.target.closest('label') || event.target;
-            el.classList.remove('flash-save', 'flash-error');
-            void el.offsetWidth;
-            el.classList.add(cls);
-            el.addEventListener('animationend', () => el.classList.remove(cls), { once: true });
-        },
-        async saveOverride(key, value, event) {
-            try {
-                const res = await fetch(rootPath + '/api/config', {
-                    method: 'PATCH',
-                    headers: { 'Content-Type': 'application/json' },
-                    body: JSON.stringify({ updates: { [key]: value } }),
-                });
-                if (res.ok) {
-                    this.overrides[key] = value;
-                    this.flashEl(event, 'flash-save');
-                } else {
-                    this.flashEl(event, 'flash-error');
-                }
-            } catch {
-                this.flashEl(event, 'flash-error');
-            }
-        },
-        async resetOverrides() {
-            if (!confirm('Reset all runtime overrides to YAML defaults? This will reload settings from config file.')) return;
-            try {
-                const res = await fetch(rootPath + '/api/config/reload', { method: 'POST' });
-                if (res.ok) {
-                    this.overrides = {};
-                    this.showMessage('Reset to defaults');
-                    setTimeout(() => location.reload(), 500);
-                }
-            } catch {
-                this.showMessage('Error resetting', true);
-            }
-        },
-        showMessage(msg, error = false) {
-            this.message = msg;
-            this.messageError = error;
-            setTimeout(() => this.message = '', 3000);
-        },
-    };
-}
-</script>
+<script src="{{ request.url_for('static', path='settings.js') }}"></script>
 {% endblock %}