fix(env): resolve 404 when loading env files and CSP inline script violation (#134)

The /envs endpoint now filters to only return env files that actually exist
on disk, and absolute env_file paths from compose files (e.g. shared
globals.env in a sibling directory) are no longer rejected. The inline
theme-detection script is moved to an external file to comply with CSP.

frontend/public/theme-init.js

@@ -0,0 +1,10 @@
+(function () {
+  try {
+    var saved = localStorage.getItem('sencho-theme');
+    if (saved === 'light') {
+      document.documentElement.classList.remove('dark');
+    } else {
+      document.documentElement.classList.add('dark');
+    }
+  } catch (e) { }
+})();