Security: Enable Content Security Policy

[bellisabell]

Summary

Enable Content Security Policy (CSP) to protect against XSS and other injection attacks.

Changes

• Uncomment and configure the CSP initializer
• default-src: self - restrict resources to same origin by default
• font-src: Allow Google Fonts (fonts.gstatic.com) and data URIs
• img-src: Allow https, data:, and blob: for images (supports external images and file uploads)
• script-src: Use self with strict-dynamic and nonces for Turbo/Stimulus compatibility
• style-src: Allow Google Fonts CSS and unsafe-inline (needed for accent color inline styles)
• connect-src: Allow self and https for API calls
• frame-src: Allow tally.so for embedded forms
• object-src: none (security best practice)
• base-uri: self (prevent base tag hijacking)
• form-action: self (restrict form submissions)

Security

This addresses a HIGH severity issue. A disabled CSP leaves the application vulnerable to:

• Cross-Site Scripting (XSS) attacks
• Data injection attacks
• Clickjacking (partially)

Testing

After deployment, verify:

1. Turbo/Stimulus features work correctly (nonces should handle inline scripts)
2. Google Fonts load properly
3. Images display correctly
4. Tally.so forms embed successfully
5. No CSP violations in browser console

If issues arise, consider enabling report_only mode first to identify violations before enforcing.

Closes #18