Remove inline event handlers for CSP compliance

[Copilot]

Inline onclick handlers violate Content Security Policy best practices and reduce maintainability. This PR moves all event handlers to proper event listeners in the respective JavaScript modules.

Changes

• HTML files (books.html, index.html): Removed onclick attributes from menu and theme toggle buttons
• menu.js: Attached click listener via btn.addEventListener('click', toggleMenu) in DOMContentLoaded
• theme.js: Attached click listener via btn.addEventListener('click', toggleTheme) in DOMContentLoaded

Before:

<button class="menu-button" onclick="toggleMenu()" aria-label="Menu">

After:

<button class="menu-button" aria-label="Menu">

// In menu.js DOMContentLoaded handler
btn.addEventListener('click', toggleMenu);

Testing

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.