fix(csp): docs + 418 sans style/script inline — CSS/JS externalisés, header/footer injectés par components.js (#h/#f), playground API déplacé dans docs-playground.js et docs.css

public/js/docs-playground.js

@@ -0,0 +1,15 @@
+(function () {
+  var form = document.getElementById("ms-form")
+  var out = document.getElementById("ms-out")
+  if (!form || !out) return
+  form.addEventListener("submit", function (e) {
+    e.preventDefault()
+    var lat = document.getElementById("ms-lat").value
+    var lon = document.getElementById("ms-lon").value
+    out.textContent = "Chargement…"
+    fetch("/api/maxspeed/point?lat=" + encodeURIComponent(lat) + "&lon=" + encodeURIComponent(lon))
+      .then(function (r) { return r.json() })
+      .then(function (d) { out.textContent = JSON.stringify(d, null, 2) })
+      .catch(function (err) { out.textContent = "Erreur: " + err })
+  })
+})()

public/js/teapot.js

@@ -0,0 +1,16 @@
+(function () {
+  var toast = document.querySelector(".tea-toast");
+  if (!toast) return;
+  var timer = null;
+  function spin(msg) {
+    toast.textContent = msg;
+    toast.classList.add("show");
+    if (timer) clearTimeout(timer);
+    timer = setTimeout(function () { toast.classList.remove("show"); }, 3200);
+  }
+  document.querySelectorAll("[data-tea]").forEach(function (b) {
+    b.addEventListener("click", function () {
+      spin(b.getAttribute("data-toast") || "");
+    });
+  });
+})();