Fix CSP: add 'unsafe-eval' to script-src for dashboard

[citadelgrad]

Summary

• Adds 'unsafe-eval' to the script-src directive in the Content-Security-Policy header
• The dashboard's inline JS framework (Alpine.js/Petite-Vue) uses new AsyncFunction(), which requires 'unsafe-eval' — without it the browser blocks execution and throws dozens of EvalError console errors

Changed file

crates/openfang-api/src/middleware.rs — one-line change in security_headers() middleware

Verification

curl -sI http://127.0.0.1:4200/ | grep -i content-security-policy

Should now include script-src 'self' 'unsafe-inline' 'unsafe-eval' and the dashboard should load without EvalError console errors.

[citadelgrad]

Security Review: 'unsafe-eval' CSP Addition

Performed a focused security review of this change. No exploitable vulnerabilities introduced by this PR.

Analysis Summary

Four potential findings were investigated and all filtered as false positives:

Finding	Concern	Verdict
XSS via Alpine.js directive injection	Attacker injects x-* attributes through x-html	False positive — Alpine.js does NOT compile directives on HTML injected via x-html; it only sets innerHTML
marked.js + x-html rendering	Unsanitized Markdown → HTML via x-html	Pre-existing — 'unsafe-inline' already permits inline event handlers (onclick, onerror); unrelated to this PR
Chat message flow	LLM responses rendered without sanitization	Pre-existing — same root cause as above
Weak CSP	'unsafe-inline' + 'unsafe-eval' = minimal CSP protection	Architectural concern, not an exploitable vuln introduced here

Why 'unsafe-eval' is needed

Alpine.js 3.15.8 uses new Function() internally to compile expressions in x-show, @click, :class, etc. Without 'unsafe-eval', the browser throws EvalError and the dashboard JS breaks.

Recommendations for follow-up

These are not blockers for this PR but worth tracking:

1. Add DOMPurify to sanitize renderMarkdown() output before x-html injection (addresses the pre-existing unsanitized Markdown pipeline)
2. Long-term: Migrate to nonce-based CSP with precompiled Alpine templates to eliminate both 'unsafe-inline' and 'unsafe-eval'