* feat: disable <meta> CSP in favour of nginx response header The CSP is now served as an HTTP response header by nginx (nix-config modules/blog.nix) so Cloudflare can parse a per-request nonce and stamp it onto the scripts it injects at the edge. A <meta> CSP cannot carry a nonce and would co-enforce alongside the header, re-blocking those scripts. * docs: explain why CSP <meta> is disabled