Load md5.js locally (avoid CORS blocking on live site)