Load the early theme script from a file so the CSP allows it

Production's Content-Security-Policy has no script-src, so it falls
back to default-src 'self' and blocks inline scripts. The inline head
script that applied the saved theme never ran on prod, leaving the
page on the system theme while the selector showed the saved choice.

Move it to resources/js/theme-init.js, built by esbuild alongside
app.js into a minified, source-mapped file loaded as a blocking script
in the head. ThemeSelector now also applies the saved colour scheme,
so the page and buttons can't disagree.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

package.json

@@ -23,7 +23,7 @@
         "lightningcss": "lightningcss --output-dir public/assets/css --sourcemap --bundle --minify resources/css/app.css",
         "fix-sourcemap": "./scripts/fix-sourcemap.sh",
         "build-css": "npm run lightningcss && npm run fix-sourcemap",
-        "build-js": "esbuild resources/js/app.js --bundle --minify --sourcemap --outfile=public/assets/js/app.js",
+        "build-js": "esbuild resources/js/app.js resources/js/theme-init.js --bundle --minify --sourcemap --outdir=public/assets/js",
         "compress": "./scripts/compress.sh",
         "build": "npm run lint && npm run build-css && npm run build-js && npm run compress"
     },