Switch CSP from Report-Only to enforcing, with an allowlist verified in a
browser against a server sending this exact header (0 violations across the
homepage, a YouTube project page, the assistant, MailerLite JSONP, GA/gtag,
and the Google Forms endpoint).
Adds the sources the old report-only policy was missing (and would have
broken if enforced blindly): Google Fonts (style/font), Font Awesome cdnjs
(style/font), MailerLite newsletter (script/connect), the Google Forms
endpoint in connect-src, plus object-src 'none'. Keeps 'unsafe-inline' for
the in-<head> consent bootstrap; the host allowlists + form-action/base-uri
are the real hardening on top of existing output escaping.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
popovskik