Drop 'unsafe-inline' from the Content-Security-Policy (closes #530)

The delete prompts on the webhook page were inline onsubmit handlers.
Each delete form now carries its question in a data-confirm attribute,
which one submit listener in static/js/app.js asks. The three style
attributes became Tailwind classes, with tailwind.css regenerated, and
the x-cloak rule moved to style.css. The policy now sends
script-src 'self' and style-src 'self'.

The browser test now answers a target's delete prompt no and then yes,
and loads the webhook list, settings and profile pages under the
policy. The README states the policy as sent.

Model: opus-5-5

internal/server/alpine_browser_test.go

@@ -1403,13 +1403,14 @@ func checkOtherPages(ctx context.Context, t *testing.T, urls ...string) {
 	}
 }
 
-// answerPrompt stands in for the user at the browser's prompt: it makes
+// answerPrompt returns a script that stands in for the user at the
-// window.confirm record the question in window.asked and give answer.
+// browser's prompt: it makes window.confirm record the question in
-// It also records in window.sent whether a form is sent once its submit
+// window.asked and give answer. It also records in window.sent whether
-// event is handled, from a listener on window, which the event reaches
+// a form is sent once its submit event is handled, from a listener on
-// after the listener static/js/app.js adds to document.
+// window, which the event reaches after the listener static/js/app.js
-func answerPrompt(answer bool) chromedp.Action {
+// adds to document.
-	return chromedp.Evaluate(fmt.Sprintf(`
+func answerPrompt(answer bool) string {
+	return fmt.Sprintf(`
 		window.asked = "";
 		window.sent = false;
 		window.confirm = (question) => {
@@ -1418,7 +1419,7 @@ func answerPrompt(answer bool) chromedp.Action {
 		};
 		window.addEventListener("submit", (event) => {
 			window.sent = !event.defaultPrevented;
-		});`, answer), nil)
+		});`, answer)
 }
 
 // checkDeletePrompt loads a webhook page and clicks Delete beside
@@ -1441,7 +1442,9 @@ func checkDeletePrompt(
 		listed bool
 	)
 
-	require.NoError(t, chromedp.Run(ctx, loadPage(url), answerPrompt(false)))
+	require.NoError(t, chromedp.Run(
+		ctx, loadPage(url), chromedp.Evaluate(answerPrompt(false), nil),
+	))
 	click(ctx, t, form+" button")
 	require.NoError(t, chromedp.Run(
 		ctx,
@@ -1451,7 +1454,9 @@ func checkDeletePrompt(
 	assert.Equal(t, question, asked, "Delete does not ask about the target")
 	assert.False(t, sent, "answering no still sends the delete form")
 
-	require.NoError(t, chromedp.Run(ctx, answerPrompt(true)))
+	require.NoError(t, chromedp.Run(
+		ctx, chromedp.Evaluate(answerPrompt(true), nil),
+	))
 	clickAndLoad(ctx, t, form+" button")
 	require.NoError(t, chromedp.Run(ctx, chromedp.Evaluate(
 		`document.querySelector('`+form+`') !== null`, &listed,