Site: Third security pass: completed the CSP nonce migration so external script tags load…

Third security pass: completed the CSP nonce migration so external script tags load correctly under the strict policy, added rate-limiting to the remaining server-side tools, hardened a couple of feed parsers and one regex shape, and shipped a small PHP unit-test runner. The service worker no longer caches HTML pages. Pure-code — no user-facing tool behaviour changes.