fix(pwa): move inline SW registration script to external file to satisfy CSP

The inline <script> for service worker registration was blocked by the
extension's script-src 'self' Content Security Policy. Extracted it to
register-sw.js and replaced the inline block with a <script src>.
Added register-sw.js to web_accessible_resources.

extension/dashboard/dashboard.html

@@ -1295,10 +1295,6 @@
 <script src="core/init.js"></script>
 
 <!-- PWA service worker registration (required for installability) -->
-<script>
+<script src="register-sw.js"></script>
-if ('serviceWorker' in navigator) {
-  navigator.serviceWorker.register('sw.js').catch(() => {});
-}
-</script>
 </body>
 </html>

extension/dashboard/register-sw.js

@@ -0,0 +1,4 @@
+// Registers the PWA service worker required for installability.
+if ('serviceWorker' in navigator) {
+  navigator.serviceWorker.register('sw.js').catch(() => {});
+}

extension/manifest.json

@@ -55,6 +55,7 @@
         "dashboard/dashboard.html",
         "dashboard/manifest.webmanifest",
         "dashboard/sw.js",
+        "dashboard/register-sw.js",
         "dashboard/screenshots/*.png",
         "dashboard/dashboard.css",
         "dashboard/data/*.js",