chore: vendor streaming-markdown@0.2.15, remove CDN dependency

[bsgdigital]

What

Self-hosts streaming-markdown@0.2.15 instead of loading it from jsDelivr CDN.

• Adds static/vendor/smd.min.js (12.6 KB, committed from npm tarball)
• Updates index.html import to /static/vendor/smd.min.js

Why

• No CDN dependency — app works fully offline / air-gapped; no external network call at runtime
• Version control — the exact bytes are in the repo, not fetched from a third party at page load
• Eliminates the CDN availability risk (jsDelivr downtime = broken streaming markdown)

SRI note

ES module import cannot carry an integrity= attribute regardless of whether the URL is remote or local (W3C limitation). Self-hosting is the practical alternative — the file is repo-controlled. The sha384 hash is documented in a comment for auditing:

sha384-T6r95ocN9t3W8tUK2Fa6FPaO7bJryyjyW0WCalrUnpgtm2qXr5xcN4vwPYEJ6vHa

This matches the hash already noted in the original PR #923 comment.

Tests

2060 tests pass (no changes to test suite needed).

[nesquena-hermes]

Triage review — companion to #923

This PR directly addresses the CDN-dependency concern raised in the #923 review:

Self-hosting option: at 12.3 KB the library is trivial to vendor under static/vendor/smd-0.2.15.js. That would eliminate CDN trust entirely.

What it does:

• Adds static/vendor/smd.min.js (12.6 KB from npm streaming-markdown@0.2.15)
• Updates index.html to import from /static/vendor/smd.min.js instead of jsDelivr CDN

Merge order note: This PR should be merged after #923, since it updates the same index.html import path that #923 introduces. If merged before #923, the import path won't exist yet. If maintainer prefers to avoid the CDN ever reaching master, these two PRs could be merged together.

Verification:

• SHA384 documented in the commit message matches the hash in feat: incremental streaming markdown via streaming-markdown (smd) #923's review: sha384-T6r95ocN9t3W8tUK2Fa6FPaO7bJryyjyW0WCalrUnpgtm2qXr5xcN4vwPYEJ6vHa ✓
• 2060 tests pass ✓
• Eliminates CDN availability risk (jsDelivr downtime / CDN compromise) ✓
• Fallback behavior in feat: incremental streaming markdown via streaming-markdown (smd) #923 (window.smd unavailable → renderMd() path) still works since the file is now local ✓

Clean, focused change. Recommend reviewing alongside #923.