harden: drop 'unsafe-inline' from style-src (closes #328)

The popup's markup no longer carries style attributes. The 42 in
index.html and in the HTML the view helpers build are now Tailwind
classes, each computing to the value it replaced, so style-src is 'self'
in both manifests, pinned in tests/manifest.test.js.

The address dot's 16 colours are written out as whole classes, because
Tailwind builds only the classes it finds in the source. The Settings
debug well is shown and hidden with the hidden class, since clearing an
inline display no longer uncovers it. Two tests that found the colour dot
by its inline style now find it by its class. Script that sets
element.style is unaffected.

Model: opus-5-5

tests/contractCreation.test.js

@@ -301,7 +301,7 @@ describe.each([
     test("a contract creation's row says so, with no colour dot and no address line", async () => {
         const html = await rowsFor(historyTx(""));
         expect(html).toContain(SENTENCE);
-        expect(html).not.toContain("background:");
+        expect(html).not.toContain("bg-[#");
         expect(html).not.toContain("am-address");
         expect(html).not.toContain("undefined");
     });
@@ -309,7 +309,7 @@ describe.each([
     test("a transaction with a recipient shows its colour dot and address", async () => {
         const html = await rowsFor(historyTx(RECIPIENT));
         expectAddressLine(html);
-        expect(html).toContain("background:#");
+        expect(html).toContain("bg-[#");
         expect(html).toContain(`<div class="am-address">${RECIPIENT}</div>`);
     });
 });