fix(mindspace): guard published pages against blocked CDN scripts

Pre-bundle Chart.js, auto-rewrite common CDN references at publish and serve time, and block unknown external script src during publication scans so interactive dashboards keep working under CSP.

Co-authored-by: Cursor <cursoragent@cursor.com>

mindspace-content-scan.test.mjs

@@ -67,6 +67,24 @@ test('scanContent can allow interactive html forms as acknowledgeable warnings',
   );
 });
 
+test('scanContent blocks unresolved external script src even when html active content is allowed', () => {
+  const result = scanContent(
+    '<script src="https://cdn.example.com/app.js"></script><script>init()</script>',
+    { format: 'html', allowHtmlActiveContent: true },
+  );
+  assert.equal(result.allowed, false);
+  assert.ok(result.findings.some((finding) => finding.type === 'html_external_script' && finding.blocking));
+});
+
+test('scanContent allows same-origin script src with active html content', () => {
+  const result = scanContent(
+    '<script src="/assets/page-data-client.js"></script><script>init()</script>',
+    { format: 'html', allowHtmlActiveContent: true },
+  );
+  assert.equal(result.allowed, true);
+  assert.ok(!result.findings.some((finding) => finding.type === 'html_external_script'));
+});
+
 test('redactContent masks secrets and strips unsafe html', () => {
   const result = redactContent(
     '手机号 13800138000\n邮箱 john@example.com\n<script>alert(1)</script>\nkey=sk_test_1234567890abcdef',