Fix CSP blocking Cloudflare Insights and add missing favicon

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: exploded

internal/middleware/security.go

@@ -12,7 +12,7 @@ func SecurityHeaders(isProd bool, next http.Handler) http.Handler {
 		}
 		w.Header().Set("Content-Security-Policy",
 			"default-src 'self'; "+
-				"script-src 'self' https://unpkg.com; "+
+				"script-src 'self' https://unpkg.com https://static.cloudflareinsights.com; "+
 				"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "+
 				"font-src 'self' https://fonts.gstatic.com; "+
 				"img-src 'self' https://image.tmdb.org data:; "+