Polish: proper HTML document, strict CSP, lazy-load three.js, a11y fixes

- add doctype, lang and viewport (page was in quirks mode, 980px on phones)
- move inline script to app.js; add Content-Security-Policy meta
- load three.js after page load
- label week slider, wire tab/tabpanel aria, fix dark-mode week numbers

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LSDgjk1Agjy9Z2UH2n8bc3

ring3d.js

@@ -4,6 +4,7 @@
    If WebGL is missing or anything fails, the flat ring stays visible. */
 (function(){
   "use strict";
+  function start(){
   try {
     if (!window.THREE) return;
     var art = document.getElementById("phase-arc-menstrual");
@@ -131,4 +132,20 @@
     var h = document.querySelector(".hero-art.has-3d"); if (h) h.classList.remove("has-3d");
     if (window.console) console.warn("3D ring disabled:", err && err.message);
   }
+  }
+
+  // three.js is big: fetch it only after the page is up, so the page shows first.
+  function loadThree(){
+    var tag = document.createElement("script");
+    tag.src = "vendor/three.min.js";
+    tag.onload = start;
+    document.head.appendChild(tag);
+  }
+  function schedule(){
+    if (window.THREE) { start(); }
+    else if (window.requestIdleCallback) { requestIdleCallback(loadThree, {timeout: 2000}); }
+    else { setTimeout(loadThree, 300); }
+  }
+  if (document.readyState === "complete") schedule();
+  else window.addEventListener("load", schedule);
 })();