security(headers): ajoute les en-têtes HTTP de sécurité et refactorise les scripts inline pour CSP

- Ajoute .htaccess avec HSTS, CSP, X-Frame-Options, X-Content-Type-Options,
  Referrer-Policy et Permissions-Policy
- Déplace les scripts inline (thème, redirection de langue) vers des fichiers JS externes
- Remplace les onclick inline par des écouteurs d'événements dans main.js
- Configure Eleventy pour copier .htaccess à la racine du site

src/_includes/partials/faq.njk

@@ -8,7 +8,7 @@
         <div class="faq-container">
             {% for item in t.faq.items %}
             <div class="faq-item">
-                <button class="faq-question" onclick="this.parentElement.classList.toggle('active')">
+                <button class="faq-question">
                     <span>{{ item.question }}</span>
                     <span class="faq-icon">+</span>
                 </button>

src/_includes/partials/nav.njk

@@ -31,9 +31,9 @@
             {% endfor %}
         </ul>
         {% if locale == 'en' %}
-        <a href="#" class="lang-switch" onclick="localStorage.setItem('oki-lang-pref','fr'); switchLanguage('fr'); return false;">{{ t.ui.lang_switch_label }}</a>
+        <a href="#" class="lang-switch" data-lang="fr">{{ t.ui.lang_switch_label }}</a>
         {% else %}
-        <a href="#" class="lang-switch" onclick="localStorage.setItem('oki-lang-pref','en'); switchLanguage('en'); return false;">{{ t.ui.lang_switch_label }}</a>
+        <a href="#" class="lang-switch" data-lang="en">{{ t.ui.lang_switch_label }}</a>
         {% endif %}
         <button id="theme-toggle" class="theme-toggle" aria-label="{{ t.ui.theme_toggle }}" title="{{ t.ui.theme_toggle }}">
             <span class="theme-icon theme-icon-dark">🌙</span>

src/_includes/partials/support.njk

@@ -26,7 +26,7 @@
                     <div class="custom-donation-form">
                         <input type="number" id="customAmountOneTime" placeholder="{{ t.support.custom_amount_placeholder }}" min="1" class="custom-amount-input">
                         <span class="currency-symbol">{{ t.support.one_time_suffix }}</span>
-                        <button onclick="handleCustomDonation('oneTime')" class="custom-donation-btn custom-donation-btn-primary">
+                        <button data-donation-type="oneTime" class="custom-donation-btn custom-donation-btn-primary">
                             {{ t.support.custom_amount_btn }}
                         </button>
                     </div>
@@ -49,7 +49,7 @@
                     <div class="custom-donation-form">
                         <input type="number" id="customAmountMonthly" placeholder="{{ t.support.custom_amount_placeholder }}" min="1" class="custom-amount-input custom-amount-input-monthly">
                         <span class="currency-symbol">{{ t.support.monthly_suffix }}</span>
-                        <button onclick="handleCustomDonation('monthly')" class="custom-donation-btn custom-donation-btn-secondary">
+                        <button data-donation-type="monthly" class="custom-donation-btn custom-donation-btn-secondary">
                             {{ t.support.custom_monthly_btn }}
                         </button>
                     </div>