fix: emit admin form script via SecureHtmlRenderer for CSP

[rhoerr]

Summary

Makes the admin form template CSP-compliant: the inline <script> block in services.phtml is now emitted via SecureHtmlRenderer::renderTag() (heredoc-built script string, dynamic pieces precomputed into escaped PHP variables — the same pattern core Magento/Config templates use), so Magento adds the CSP hash/nonce and strict-CSP admin (2.4.7+) no longer blocks it. JS logic is unchanged — this is a relocation, not a rewrite.

Also carries the chain's CHANGELOG/README updates for all four follow-ups.

PR chain (stacked on #2; each retargets as its base merges): Grok/xAI dedupe → api_key rename → masked credentials → CSP. All are pre-1.0.0, so the breaking changes need no migration.

Test plan

• Template rendered with stub objects; emitted JS passes node --check, placeholder shown, no plaintext credentials in output.
• vendor/bin/phpcs exits 0 (avoided ob_start(), which the Magento2 standard flags).

🤖 Generated with Claude Code