feat(security,ui): self-host React deps, Tailwind, fonts; strict CSP; local QR; better selection state

Replace CDN React/ReactDOM/Babel with local libs; remove Babel and inline scripts
Build Tailwind locally, add safelist; switch to assets/tailwind.css
Self-host Font Awesome and Inter (CSS + woff2); remove external font CDNs
Implement strict CSP (no unsafe-inline/eval; scripts/styles/fonts from self)
Extract inline handlers; move PWA scripts to external files
Add local QR code generation (qrcode lib) and remove api.qrserver.com
Improve SessionTypeSelector visual selection (highlighted background and ring)
Keep PWA working with service worker and offline assets
Refs: CSP hardening, offline-first, no external dependencies

node_modules/p-limit/index.d.ts

@@ -0,0 +1,38 @@
+export interface Limit {
+	/**
+	@param fn - Promise-returning/async function.
+	@param arguments - Any arguments to pass through to `fn`. Support for passing arguments on to the `fn` is provided in order to be able to avoid creating unnecessary closures. You probably don't need this optimization unless you're pushing a lot of functions.
+	@returns The promise returned by calling `fn(...arguments)`.
+	*/
+	<Arguments extends unknown[], ReturnType>(
+		fn: (...arguments: Arguments) => PromiseLike<ReturnType> | ReturnType,
+		...arguments: Arguments
+	): Promise<ReturnType>;
+
+	/**
+	The number of promises that are currently running.
+	*/
+	readonly activeCount: number;
+
+	/**
+	The number of promises that are waiting to run (i.e. their internal `fn` was not called yet).
+	*/
+	readonly pendingCount: number;
+
+	/**
+	Discard pending promises that are waiting to run.
+
+	This might be useful if you want to teardown the queue at the end of your program's lifecycle or discard any function calls referencing an intermediary state of your app.
+
+	Note: This does not cancel promises that are already running.
+	*/
+	clearQueue(): void;
+}
+
+/**
+Run multiple promise-returning & async functions with limited concurrency.
+
+@param concurrency - Concurrency limit. Minimum: `1`.
+@returns A `limit` function.
+*/
+export default function pLimit(concurrency: number): Limit;