Apply Fresh 2's csp middleware globally with project img-src extension

Replaces the per-route useCSP() hook (deleted alongside utils/csp.ts
in the previous commit) with the Fresh 2 built-in `csp` middleware
applied at the App level. This is strictly more secure than the
Fresh 1 setup: CSP now applies to every route, not just the three
deletion/account pages that explicitly opted in.

Configuration:
- `useNonce: true` swaps the default 'unsafe-inline' allowance for
  per-request nonces that Fresh auto-injects into the inline
  scripts/styles it emits during render.
- The single override extends `img-src` to permit `avatars.github
  usercontent.com` (OAuth-provided GitHub avatars) and
  `www.gravatar.com` (developer profile avatars). The Fresh 2
  defaults cover everything else: default-src 'self', script/style
  via nonces, frame-ancestors 'none', base-uri 'self', form-action
  'self', upgrade-insecure-requests, etc.

Tests unchanged (11 pass, e2e still ignored pending build-cache test
harness — tracked separately).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: kevingorski

main.ts

@@ -1,9 +1,27 @@
-import { App, staticFiles } from "fresh";
+import { App, csp, staticFiles } from "fresh";
 import type { State } from "@/routes/_middleware.ts";
 
 export const app = new App<State>();
 
 app.use(staticFiles());
+
+// Content-Security-Policy. Fresh 2's `csp` middleware ships sensible
+// defaults (default-src 'self', script/style-src 'self' 'unsafe-inline',
+// frame-ancestors 'none', base-uri 'self', upgrade-insecure-requests, etc.);
+// `useNonce: true` swaps the 'unsafe-inline' allowance for per-request
+// nonces that Fresh injects into the inline scripts/styles it emits.
+//
+// We only need to extend `img-src` to permit the two avatar hosts used by
+// developer profiles: GitHub OAuth avatars and Gravatar.
+app.use(
+  csp({
+    useNonce: true,
+    csp: [
+      "img-src 'self' data: avatars.githubusercontent.com www.gravatar.com",
+    ],
+  }),
+);
+
 app.fsRoutes();
 
 if (import.meta.main) {