Drop 'unsafe-inline' from the Content-Security-Policy (closes #530)

The delete prompts on the webhook page were inline onsubmit handlers.
Each delete form now carries its question in a data-confirm attribute,
which one submit listener in static/js/app.js asks. The three style
attributes became Tailwind classes, with tailwind.css regenerated, and
the x-cloak rule moved to style.css. The policy now sends
script-src 'self' and style-src 'self'.

The browser test now answers a target's delete prompt no and then yes,
and also loads the sign-in page, the webhook list, the settings and
profile pages and the 404 error page under the policy. The README
states the policy as sent.

Model: opus-5-5

internal/handlers/event_body.go

@@ -35,11 +35,10 @@ const eventBodyQuery = "SELECT cast(body as blob) " +
 // response is deliberately not renderable. Content-Disposition
 // makes the browser download rather than display it, and the
 // octet-stream type plus nosniff stop it being interpreted as
-// HTML or script. Without those a stored payload would execute
-// as the logged-in operator. The application's CSP does not
-// help here: script-src allows 'unsafe-inline' from 'self', so
-// a document served from this origin could run its own inline
-// script.
+// HTML or script. Without those a stored payload would be shown
+// as a page of the operator's own origin. The application's CSP
+// is a second defence behind them: it allows no inline script,
+// so such a page could not run script of its own.
 func (h *Handlers) HandleEventBodyDownload() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		webhook, ok := h.ownedWebhook(w, r)