Remove all inline JS from admin templates

script-src 'self' blocks inline onclick handlers and <script> blocks.
Migrate all interactive behavior to data-* attributes wired by mcias.js:

- data-toggle-form: accounts, policies, pgcreds create-form buttons
- data-href: audit clickable table rows
- data-tab: policy form tab switching (moved showTab from inline script)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

web/templates/policies.html

@@ -6,12 +6,15 @@
     <h1>Policy Rules</h1>
     <p class="text-muted text-small">{{len .Rules}} operator rules (built-in defaults not shown)</p>
   </div>
-  <button class="btn btn-primary" onclick="document.getElementById('create-form').style.display='block';this.style.display='none'">
+  <button class="btn btn-primary"
+          data-toggle-form="create-form"
+          data-label-show="Add Rule"
+          data-label-hide="Cancel">
     Add Rule
   </button>
 </div>
 
-<div id="create-form" class="card mt-2" style="display:none">
+<div id="create-form" class="card mt-2" hidden>
   <h2 style="font-size:1rem;font-weight:600;margin-bottom:1rem">Create Policy Rule</h2>
   {{template "policy_form" .}}
 </div>