feat: expand CSP connect-src directive and add async loading guard for highlight.js in popout view

- Add cdnjs.cloudflare.com, fonts.googleapis.com, and fonts.gstatic.com to connect-src CSP directive
- Add waitForHljs helper function with 50 attempt limit and 100ms polling interval
- Check if hljs is defined before highlighting code blocks in popout view
- Fall back to async waiting if hljs not immediately available to prevent undefined reference errors

frontend/popout.html

@@ -752,10 +752,18 @@ const RightSidebarManager = {
 
         OutlineManager.init(); RightSidebarManager.init();
 
-        // Highlight code blocks
-        document.querySelectorAll('pre code').forEach((el) => {
-          hljs.highlightElement(el);
-        });
+        // Highlight code blocks (wait for hljs to be available)
+        if (typeof hljs !== 'undefined') {
+          document.querySelectorAll('pre code').forEach((el) => {
+            hljs.highlightElement(el);
+          });
+        } else {
+          waitForHljs().then(() => {
+            document.querySelectorAll('pre code').forEach((el) => {
+              hljs.highlightElement(el);
+            });
+          });
+        }
 
         // Hide loading
         document.getElementById('loading').style.opacity = '0';
@@ -768,6 +776,14 @@ const RightSidebarManager = {
       }
     }
 
+    async function waitForHljs() {
+      let attempts = 0;
+      while (typeof hljs === 'undefined' && attempts < 50) {
+        await new Promise((resolve) => setTimeout(resolve, 100));
+        attempts++;
+      }
+    }
+
     async function waitForCodeMirror() {
       let attempts = 0;
       while (!window.CodeMirror && attempts < 50) {