Add Subresource Integrity (SRI) for any CDN-loaded scripts

[Marvell69]

Description
If any external scripts are loaded from a CDN (fonts, analytics, or third-party embeds), they should use Subresource Integrity hashes so a compromised CDN can't silently inject malicious code into the app.

Requirements and context

• Audit all <script src="..."> tags loading from external origins
• Add integrity and crossorigin attributes where feasible
• Document any that can't use SRI (e.g. scripts that update frequently server-side) and why

Suggested execution

git checkout -b fix/add-sri-external-scripts

• Audit and add SRI hashes to external script tags
• Document exceptions

Example commit message
fix: add Subresource Integrity to externally-loaded scripts