Drop 'unsafe-inline' from the Content-Security-Policy (closes #530)

The delete prompts on the webhook page were inline onsubmit handlers.
Each delete form now carries its question in a data-confirm attribute,
which one submit listener in static/js/app.js asks. The three style
attributes became Tailwind classes, with tailwind.css regenerated, and
the x-cloak rule moved to style.css. The policy now sends
script-src 'self' and style-src 'self'.

The browser test now answers a target's delete prompt no and then yes,
and loads the webhook list, settings and profile pages under the
policy. The README states the policy as sent.

Model: opus-5-5

templates/settings.html

@@ -13,13 +13,11 @@
             <div class="p-4">
                 <!-- A value too wide to sit beside its name moves to the
                      next line, where a list breaks only at the spaces
-                     between its entries. overflow-wrap: anywhere breaks
-                     inside a value only when it alone is wider than the
-                     line; an inline style, because the committed
-                     tailwind.css has no class for it. -->
+                     between its entries. wrap-anywhere breaks inside a
+                     value only when it alone is wider than the line. -->
                 <div class="flex flex-wrap justify-between items-start gap-4">
                     <code class="text-sm font-medium text-gray-900">{{.Name}}</code>
-                    <code class="text-sm text-gray-900" style="overflow-wrap: anywhere">{{.Value}}</code>
+                    <code class="text-sm text-gray-900 wrap-anywhere">{{.Value}}</code>
                 </div>
                 <p class="text-sm text-gray-500 mt-1">{{.Description}}</p>
             </div>