fix(security): replace CSP unsafe-inline with sha256 script hashes

[NewCoder3294]

Summary

• Replaced 'unsafe-inline' in the script-src directive of the Content-Security-Policy header in vercel.json with explicit SHA256 hashes of all known inline scripts
• This hardens the CSP by only allowing specific, pre-approved inline scripts to execute, preventing XSS attacks via arbitrary inline script injection
• The sha256 hashes match those already present in the index.html <meta> CSP tag, ensuring consistency between the HTTP header and meta tag policies

Inline scripts hashed

Script	Hash
Theme/variant init (FOUC prevention)	sha256-LnMFPWZxTgVOr2VYwIh9mhQ3l/l3+a3SfNOLERnuHfY=
Vite module preload polyfill	sha256-+SFBjfmi2XfnyAT3POBxf6JIKYDcNXtllPclOcaNBI0=
Vite build-injected script	sha256-AhZAmdCW6h8iXMyBcvIrqN71FGNk4lwLD+lPxx43hxg=
Vite build-injected script	sha256-PnEBZii+iFaNE2EyXaJhRq34g6bdjRJxpLfJALdXYt8=

Security benefit

'unsafe-inline' in script-src effectively disables one of the most important CSP protections — it allows any inline <script> tag to execute, which is the primary vector for XSS attacks. By replacing it with sha256 hashes, only the exact known inline scripts are permitted. Any injected malicious script will be blocked by the browser.

Test plan

• npx tsx --test tests/deploy-config.test.mjs — all 13 tests pass, including the specific test "CSP script-src uses hashes instead of unsafe-inline" (line 143-147)
• Verify deployed site loads correctly (theme init script, Vite module preload, etc.)
• Check browser console for CSP violation errors after deployment

🤖 Generated with Claude Code

[vercel]

@NewCoder3294 is attempting to deploy a commit to the Elie Team on Vercel.

A member of the Team first needs to authorize it.