🎩 What? Why?

Remove all executable inline JavaScript from views, cells, and helpers to prepare for CSP hardening.

• Moves all inline <script> blocks from views and cells to Stimulus controllers
• Replaces <script type="text/template"> with HTML <template> elements
• Removes jquery-tmpl vendor dependency (source of unsafe-eval requirement)
• Migrates Decidim.config initialization to inert <script type="application/json"> blocks with hydration from external JS
• Removes all inline event handlers (onclick, onchange) from views and Ruby helpers
• Updates dynamic_fields.component.js to work with <template> elements instead of <script type="text/template">
• Replaces map marker popup rendering with native DOM API instead of jquery-tmpl
• Fixes HTML escaping in map marker popups: state labels (Evaluating, Accepted, etc.) now render as styled badges instead of raw HTML text

📌 Related Issues

• Related to Content Security Policy directive - unsafe-inline - SECURITY #16088

Testing

Describe the best way to test or validate your PR.

♥️ Thank you!

💰 Funding
This action is funded by Pokecode as an offering to the Decidim Association following the partners' meeting held on March 20th at Pokecode's request. This action is independent of Pokecode's partner fees. It is an offering of technical resources at zero cost as a show of support for the Decidim Association at a time when they have fewer technical resources available