fix(mindspace): guard published pages against blocked CDN scripts

Pre-bundle Chart.js, auto-rewrite common CDN references at publish and serve time, and block unknown external script src during publication scans so interactive dashboards keep working under CSP.

Co-authored-by: Cursor <cursoragent@cursor.com>

mindspace-content-scan.mjs

@@ -92,6 +92,15 @@ const HTML_RULES = [
     mask: () => '<script>…</script>',
     replacement: () => '',
   },
+  {
+    type: 'html_external_script',
+    label: '外部 CDN 脚本',
+    riskLevel: 'high',
+    blocking: true,
+    pattern: /<script\b[^>]*\bsrc\s*=\s*(['"])((?:https?:)?\/\/[^'"]+)\1/gi,
+    mask: (_value, _quote, src) => String(src).slice(0, 72),
+    replacement: () => '',
+  },
   {
     type: 'html_inline_handler',
     label: '内联事件',