sneak 81bac1aa3e Load Alpine's CSP build so the UI's directives run (closes #371) ...

The pages' Content-Security-Policy forbids eval, which the standard
Alpine.js build needs, so no directive ran: add forms showed open and
events never collapsed. 3p/ now holds the @alpinejs/csp 3.14.9 tarball
instead, and every directive in templates/ names a property or method
of a component registered in static/js/app.js, as that build requires.
The policy is unchanged.

A headless Chromium test in internal/server loads the webhook page and
the event log under the real headers. The Dockerfile's test stage
installs chromium; where it is missing the test skips.

Model: opus-5-5

2026-10-01 21:21:12 +00:00

..

app.js

Load Alpine's CSP build so the UI's directives run (closes #371)

2026-10-01 21:21:12 +00:00