Harden and polish strategy switch console

[Pigbibi]

Summary

• polish the strategy switch console UI into a cleaner four-platform operation surface with a compact language toggle
• remove main-page dynamic innerHTML rendering in favor of DOM APIs
• add Worker security headers and require same-origin Origin on state-changing POST endpoints
• document the architecture and security review findings

Validation

• jq empty web/strategy-switch-console/strategy-profiles.example.json
• node --experimental-default-type=module tests/strategy_switch_worker_validation.mjs
• sed -n '/<script>/,/</script>/p' web/strategy-switch-console/index.html | sed '1d;' | node --check --input-type=commonjs
• node --check --input-type=module < web/strategy-switch-console/page_asset.js
• node --check --input-type=module < web/strategy-switch-console/strategy_profiles_asset.js
• node --check --input-type=module < web/strategy-switch-console/worker.js
• python3 scripts/runtime_settings.py validate
• python3 -m unittest discover -s tests -v