CDN scripts pinned to @latest / unpinned major version — no SRI, no lockstep

\`docs/index.html\` and \`templates/plan-template.html\` both load:
- \`https://unpkg.com/lucide@latest\` — fully unpinned, can change under you at any time with no warning.
- \`https://cdn.jsdelivr.net/npm/@tailwindcss/browser@4\` — pinned to major \`4\` only, minor/patch can shift.

Neither has a Subresource Integrity (\`integrity=\`) hash (Font Awesome's \`\` does have one, so there's already a precedent in the codebase — see \`docs/index.html\` line 9). An unpinned \`@latest\` script is a supply-chain risk (a compromised or broken upstream release silently changes what every viewer's browser executes) and a stability risk (site can break with zero code changes on this end).

Also relevant to \`src/index.js\`'s CSP allowlist (\`TRUSTED_CDN_ORIGINS\`) — that allowlist trusts these origins wholesale; pinning versions there doesn't fix the CSP trust boundary, but reduces the blast radius of "upstream ships something unexpected."

**Ask:** pin \`lucide\` to an exact version (e.g. \`lucide@0.474.0\`) and add \`integrity\` + \`crossorigin\` attributes to both CDN \`\` tags, matching the pattern already used for the Font Awesome \`<link>\`.

— filed by Claude

Inspect the CDN script tags in docs/index.html and templates/plan-template.html, then compare docs/index.html line 9 for the existing Font Awesome integrity pattern. Check src/index.js and its TRUSTED_CDN_ORIGINS allowlist for context. Done means both scripts use an exact version and include matching integrity and crossorigin attributes.

Written by the indexing model from the issue text.