feat: add a Content-Security-Policy to the page routes

[cletqui]

Follow-up A from the review. Stacked on #105 — GitHub will retarget this to main once #105 merges.

New pageCsp middleware (src/utils/headers.tsx) applied only to / and /template, so the JSON API and the CDN-backed Swagger UI are untouched.

default-src 'self';
script-src 'self' 'nonce-<per-request>';
style-src 'self' 'unsafe-inline';
img-src 'self' data: https://avatars.githubusercontent.com https://*.githubusercontent.com;
connect-src 'self'; manifest-src 'self';
base-uri 'none'; object-src 'none';
form-action 'self' https://github.com; frame-ancestors 'none'

• Nonce for streaming: hono's stream: true Suspense emits ~4 inline hydration <script> tags. A per-request nonce is generated in pageCsp, stashed on c.var.cspNonce, and threaded into those scripts via <StreamingContext.Provider value={{ scriptNonce }}> in renderer.tsx. Verified locally: the header nonce and every streamed <script nonce="…"> match within a request; zero un-nonced inline scripts.
• style-src 'unsafe-inline' stays — the language-dot colour is a dynamic style attribute and style attributes can't carry a nonce. Low risk (all rendered strings are hono-escaped; no HTML-injection surface).
• /static/script.js is src-based, allowed by script-src 'self'.

tsc clean, build OK (484 kB), wrangler pages dev dist boots; / and /template carry the CSP, /api and /api/swagger do not.

Needs a real browser pass before merge (I can't do this offline): open the preview with the devtools console and confirm — repo renders and streams in, avatars load, /api/swagger still works, and there are no CSP violation errors. Tell me what to loosen if anything breaks.

[cloudflare-workers-and-pages]

Deploying petithub with    Cloudflare Pages

Latest commit:	89fd657
Status:	✅  Deploy successful!
Preview URL:	https://b4b66d11.petithub.pages.dev
Branch Preview URL:	https://petithub-csp.petithub.pages.dev

View logs