Site: Second security hardening pass: nonce-based Content Security Policy (no unsafe-inline for…

Second security hardening pass: nonce-based Content Security Policy (no unsafe-inline for scripts), additional protections on server-side fetches, response-size caps on upstream data feeds, and removal of unused code paths. Pure-code — no user-facing tool behaviour changes.