Drop 'unsafe-inline' from the Content-Security-Policy (closes #530)

The delete prompts on the webhook page were inline onsubmit handlers.
Each delete form now carries its question in a data-confirm attribute,
which one submit listener in static/js/app.js asks. The three style
attributes became Tailwind classes, with tailwind.css regenerated, and
the x-cloak rule moved to style.css. The policy now sends
script-src 'self' and style-src 'self'.

The browser test now answers a target's delete prompt no and then yes,
and loads the webhook list, settings and profile pages under the
policy. The README states the policy as sent.

Model: opus-5-5

README.md

@@ -1235,34 +1235,36 @@ markup. The CSP build runs no expressions, so every Alpine directive in
 `static/js/app.js`: `x-data="collapsible"` and `@click="toggle"`, never
 `x-data="{ open: false }"` or `@click="open = !open"`.
 
-A browser test in `internal/server` loads the webhook page, its edit pages and
-the event log under the real policy and checks that: the add entrypoint form
-stays hidden until Add is clicked; for every target type, the targets section's
-Add shows only a choice of type with Next and Cancel, Next shows only that
-type's fields (no url field for `database` or `log`), Cancel at either step
-closes the form, and saving adds the target; a refused target comes back with
-its form open, the values entered and the reason, and after Cancel the next Add
-starts with an empty form and no reason; a refused save on the target edit page
-and on the webhook edit page comes back with the reason and every value entered;
-the Copy button beside an entrypoint URL reads "Copied" once clicked; an
-entrypoint's Edit button shows its edit form in place of its description and
-hides until the form closes, Cancel hides the form and drops what was typed, as
-does leaving the page and going back to it, and Save changes the description; of
-the recent events on the webhook page only the newest starts expanded, each
-expands and collapses, and Open leads to the event's own page; of the events in
-the event log only the newest starts expanded, and an event there expands and
-collapses when its row's caret or its ID is clicked, and from the keyboard, but
-not when its ID is selected with the mouse, and a delivery's attempts inside it
-expand and collapse; and at phone width the menu button opens and closes the
-mobile menu, and neither the webhook page nor the event log, with a delivery's
-attempts open, scrolls sideways or cuts anything off at the page's or a card's
-edge. It also fails if the browser reports a console warning or error, an
-uncaught exception, or anything the policy refused. `make check` and the image
-build lint it but do not run it, and `make test` leaves it out (its file is
-built only with the `browser` build tag). Run it with `make test-browser` after
-changing `templates/` or `static/js/`: that builds `Dockerfile.browser`, which
-runs the test in a digest-pinned headless browser image, so the host needs no
-browser.
+A browser test in `internal/server` loads the webhook page, its edit pages, the
+event log, the webhook list, the settings page and the profile page under the
+real policy and checks that: the add entrypoint form stays hidden until Add is
+clicked; for every target type, the targets section's Add shows only a choice of
+type with Next and Cancel, Next shows only that type's fields (no url field for
+`database` or `log`), Cancel at either step closes the form, and saving adds the
+target; a refused target comes back with its form open, the values entered and
+the reason, and after Cancel the next Add starts with an empty form and no
+reason; a refused save on the target edit page and on the webhook edit page
+comes back with the reason and every value entered; the Copy button beside an
+entrypoint URL reads "Copied" once clicked; an entrypoint's Edit button shows
+its edit form in place of its description and hides until the form closes,
+Cancel hides the form and drops what was typed, as does leaving the page and
+going back to it, and Save changes the description; of the recent events on the
+webhook page only the newest starts expanded, each expands and collapses, and
+Open leads to the event's own page; of the events in the event log only the
+newest starts expanded, and an event there expands and collapses when its row's
+caret or its ID is clicked, and from the keyboard, but not when its ID is
+selected with the mouse, and a delivery's attempts inside it expand and
+collapse; at phone width the menu button opens and closes the mobile menu, and
+neither the webhook page nor the event log, with a delivery's attempts open,
+scrolls sideways or cuts anything off at the page's or a card's edge; and a
+target's Delete asks first, naming the target, sends nothing when the answer is
+no and deletes the target when it is yes. It also fails if the browser reports a
+console warning or error, an uncaught exception, or anything the policy refused.
+`make check` and the image build lint it but do not run it, and `make test`
+leaves it out (its file is built only with the `browser` build tag). Run it with
+`make test-browser` after changing `templates/` or `static/js/`: that builds
+`Dockerfile.browser`, which runs the test in a digest-pinned headless browser
+image, so the host needs no browser.
 
 The package's tarball is committed as `3p/alpinejs-csp-3.14.9.tgz`, byte for
 byte as the npm registry publishes it. It is a dependency, not this repo's build
@@ -1295,7 +1297,9 @@ and commit the regenerated file with the change. Tailwind takes classes only
 from the files that `input.css` names in its `@source` lines; a class written in
 any other file is not generated until that file is named there too. `make check`
 and the image build fail when the committed file differs from what `make css`
-generates. `static/css/style.css` is hand-written and is not generated.
+generates. `static/css/style.css` is hand-written and is not generated. The
+pages' Content-Security-Policy refuses inline styles, so a template styles an
+element with a class, never a `style` attribute.
 
 `make css` runs the Tailwind standalone CLI in Docker, at the version and sha256
 pinned in the Dockerfile's stylesheet stages; it is never installed on the host.
@@ -3076,8 +3080,8 @@ webhooker/
 │   ├── static.go              # //go:embed directive
 │   ├── css/input.css          # Tailwind input, source for tailwind.css (make css)
 │   ├── css/tailwind.css       # Generated stylesheet the pages load
-│   ├── css/style.css          # Hand-written, loaded after tailwind.css: btn-small, the pointer cursor for input.css's buttons, the webhook list cards' focus outline
-│   ├── js/app.js              # Copy-to-clipboard, and the Alpine.js components
+│   ├── css/style.css          # Hand-written, loaded after tailwind.css: btn-small, the pointer cursor for input.css's buttons, the webhook list cards' focus outline, the rule hiding x-cloak elements
+│   ├── js/app.js              # Copy-to-clipboard, the delete prompts, and the Alpine.js components
 │   └── js/alpine.min.js       # Alpine.js CSP build, extracted from 3p/ by make assets, not committed
 ├── templates/                 # Go HTML templates (base, login, sources, etc.)
 ├── script/                    # Scripts to Rule Them All entrypoints
@@ -3131,8 +3135,9 @@ Applied to all routes in this order:
 
 1. **RequestID** — Generate unique request IDs (chi built-in)
 2. **SecurityHeaders** — Production security headers on every response (HSTS
-   unless `HSTS_MAX_AGE` is `0`, X-Content-Type-Options, X-Frame-Options, CSP,
-   Referrer-Policy, Permissions-Policy)
+   unless `HSTS_MAX_AGE` is `0`, X-Content-Type-Options, X-Frame-Options, CSP
+   `default-src 'self'; script-src 'self'; style-src 'self'`, Referrer-Policy,
+   Permissions-Policy)
 3. **Logging** — Structured request logging (method, URL, status, latency,
    remote IP, client IP, user agent, request ID)
 4. **Metrics** — Prometheus HTTP metrics (if `METRICS_USERNAME` and
@@ -3217,6 +3222,12 @@ credential check, see [The login endpoint](#the-login-endpoint).
 - Production security headers on all responses: HSTS (unless `HSTS_MAX_AGE` is
   `0`), X-Content-Type-Options (`nosniff`), X-Frame-Options (`DENY`),
   Content-Security-Policy, Referrer-Policy, and Permissions-Policy
+- The Content-Security-Policy is
+  `default-src 'self'; script-src 'self'; style-src 'self'`: a page takes
+  scripts and styles only from files webhooker serves, and the browser runs no
+  inline script or event handler and ignores any `<style>` element or `style`
+  attribute in a page. The pages need none: their scripts are in `static/js/`
+  and their styles in `static/css/`
 - Request body size limits (1 MB) on all form POST endpoints, enforced by
   middleware that runs before CSRF parses the form
 - **CSRF protection** via [gorilla/csrf](https://github.com/gorilla/csrf) on all