Load Alpine's CSP build so the UI's directives run (closes #371)

The pages' Content-Security-Policy forbids eval, which the standard
Alpine.js build needs, so no directive ran: add forms showed open and
events never collapsed. 3p/ now holds the @alpinejs/csp 3.14.9 tarball
instead, and every directive in templates/ names a property or method
of a component registered in static/js/app.js, as that build requires.
The policy is unchanged.

A browser test in internal/server, built only with the browser tag,
loads the webhook page and the event log under the real headers.
make test-browser runs it in Docker, in a digest-pinned headless
browser image (Dockerfile.browser).

Model: opus-5-5

Dockerfile

@@ -26,7 +26,7 @@ COPY . .
 # Dockerfile.lint, including --network=none (see its header for why).
 RUN make fmt-check
 RUN --network=none golangci-lint config verify --config .golangci.yml
-RUN --network=none golangci-lint run --config .golangci.yml ./...
+RUN --network=none golangci-lint run --config .golangci.yml --build-tags browser ./...
 
 # Build stage
 # golang:1.26.1-bookworm (Debian-based), 2026-03-17