fix(renderer): add window.electronAPI shim and update CSP for KaTeX

The main window uses nodeIntegration without preload, so window.electronAPI
was undefined. This caused the DOMContentLoaded handler to crash at:
  await window.electronAPI.getAppVersion()
which prevented the CodeMirror editor from being created (blank source
window) and stopped renderer-ready from being sent (broken menu/options).

Fixes:
1. Add window.electronAPI shim at top of renderer.js wrapping ipcRenderer.
2. Update CSP meta tag to allow KaTeX CDN (style-src, script-src, font-src).

Amit Haridas

src/index.html

@@ -4,7 +4,7 @@
     <meta charset="UTF-8">
     <!-- CSP: unsafe-inline/unsafe-eval required for marked.js extensions and Mermaid -->
     <!-- TODO: Migrate to nonce-based CSP for better security -->
-    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' https://www.plantuml.com;">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; img-src 'self' data: blob:; font-src 'self' data: https://cdn.jsdelivr.net; connect-src 'self' https://www.plantuml.com;">
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>MarkdownConverter</title>
     <!-- Design tokens - loaded first for CSS variable availability -->

src/renderer.js

@@ -4,6 +4,17 @@
  */
 
 const { ipcRenderer } = require('electron');
+
+// Shim window.electronAPI for main window which uses nodeIntegration
+// without preload script (window.electronAPI is normally set by preload.js).
+if (typeof window !== 'undefined' && !window.electronAPI) {
+    window.electronAPI = {
+        getAppVersion: () => ipcRenderer.invoke('get-app-version'),
+        invoke: (channel, data) => ipcRenderer.invoke(channel, data),
+        on: (channel, callback) => ipcRenderer.on(channel, (event, ...args) => callback(...args))
+    };
+}
+
 const marked = require('marked');
 const { markedHighlight } = require('marked-highlight');
 const createDOMPurify = require('dompurify');