fix(csp): eliminate inline scripts to fix Safari CSP violations

[penso]

Summary

• Move all executable inline <script> tags to external files or non-executable types
• Only the import map remains inline with a CSP nonce (required by spec)
• CSP policy unchanged: script-src 'self' 'nonce-{uuid}' — no unsafe-inline added
• Fixes Safari false-positive CSP violation reports on all 6 inline scripts

Changes

Before (inline + nonce)	After
Theme init IIFE	External js/theme-init.js (no nonce, allowed by 'self')
window.__MOLTIS__ = {...}	<script type="application/json" id="__MOLTIS_GON__"> (non-executable, no CSP check)
Favicon emoji inline	Deleted (handled by app.js → applyIdentityFavicon())
Import map	Unchanged — inline with nonce (only remaining nonce)
Title update inline	Deleted (handled by app.js → applyIdentity())
app.js module (external)	Removed nonce (external scripts allowed by 'self')

Applied same pattern to login.html and onboarding.html.

Validation

Completed

• cargo test — all 345 gateway tests pass, full suite green
• just format-check — clean
• cargo clippy -p moltis-gateway -- -D warnings — clean
• biome check --write — JS files formatted

Remaining

• Manual QA: open in Safari, verify 0 (or 1) CSP errors in Web Inspector
• Manual QA: verify no FOUC on page load (theme-init.js loads early)
• Manual QA: verify gon data loads (identity shown in header, models load)
• Manual QA: verify login page branding (title, favicon)
• E2E tests (npx playwright test)

Manual QA

Pending — requires running the gateway and checking Safari Web Inspector for CSP violation logs.

[codspeed-hq]

Merging this PR will not alter performance

✅ 34 untouched benchmarks
⏩ 1 skipped benchmark¹

---

_{Comparing unsafe-inline (6253810) with main (7fdb040)}

Footnotes

1. 1 benchmark was skipped, so the baseline result was used instead. If it was deleted from the codebase, click here and archive it to remove it from the performance reports. ↩

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!