platform: Tighten Content Security Policy

[jeromehardaway]

Intent

Tighter CSP: script-src currently allows unsafe-inline and unsafe-eval.

Scope

• Remove unsafe-eval (and unsafe-inline where feasible) using nonces/hashes.
• Verify third-party embeds (Donorbox, Shopify, Cloudinary) still work; document any exceptions.

Acceptance criteria

• CSP without unsafe-eval; unsafe-inline removed where possible
• Embeds functional
• Exceptions documented

Touches: Cross-cutting.