CSP

Astro build output should use hash-based CSP where the frontend app enables Astro security CSP.

Rule

• Validate CSP with astro build and preview.
• Do not add unsafe-inline as the default answer.
• External scripts and styles need explicit allow-listing.
• CSP belongs in app config, not scattered page code.