Vendored dashboard dependencies.

These were previously loaded from cdn.jsdelivr.net with no integrity hash (and
`marked` with no version pin at all). The dashboard has unauthenticated write
access to the local memory store, so a compromised or simply-updated CDN script
would have had full reach into it. They are vendored so that `omni-memory ui`
makes zero network requests, which is what the README's "100% local, no cloud,
no telemetry" claim requires.

  d3.min.js       7.9.0     https://cdn.jsdelivr.net/npm/d3@7.9.0/dist/d3.min.js
  marked.min.js   15.0.12   https://cdn.jsdelivr.net/npm/marked@15.0.12/marked.min.js
  mermaid.min.js  10.9.8    https://cdn.jsdelivr.net/npm/mermaid@10.9.8/dist/mermaid.min.js

To refresh, download the pinned URL above and verify the dashboard still renders
the graph (d3), the Docs tab (marked), and mermaid code fences.

Note: marked does NOT sanitize its output. Anything rendered through it must go
through sanitizeHtml() in index.html — memory text can originate from an
imported team shard, which is repo-controlled and therefore untrusted.
