Split into external app.js + style.css (HF static CSP blocks inline scripts); embed data

initial commit