fix: use unsafe-inline instead of nonce in dev style-src (nonce makes unsafe-inline ignored)

src/lib/security/csp.ts

@@ -9,7 +9,7 @@ export function buildContentSecurityPolicy(nonce: string, development: boolean):
   const directives = [
     "default-src 'self'",
     `script-src ${scriptSources.join(' ')}`,
-    `style-src 'self' 'nonce-${nonce}'${development ? " 'unsafe-inline'" : ''}`,
+    `style-src 'self'${development ? " 'unsafe-inline'" : ` 'nonce-${nonce}'`}`,
     "img-src 'self' data: blob:",
     "font-src 'self' data:",
     `connect-src 'self'${development ? ' ws: wss:' : ''}`,