feat: add dashboard client script

[maekuss]

Adds front-end dashboard logic (dashboard.js).

Scanner test PR — intentionally vulnerable (client-side). Expected High findings:

• DOM-based XSS — location.hash written to innerHTML in renderTab() (High)
• Insecure postMessage handler — no origin check, e.data.html used as an HTML sink (High)
• Client-side Prototype Pollution — query-string key path deep-set into an object (?k=__proto__.isAdmin) (High)