fix(csp): allow unsafe-inline scripts for SvelteKit hydration bootstrap

The static-adapter build emits an inline <script> with the hydration
payload; ``script-src 'self'`` alone blocks the SPA from starting
(browser error: "Executing inline script violates the following Content
Security Policy directive").

Mirrors the 'unsafe-inline' already present for style-src. Primary XSS
protection still comes from Svelte's auto-escaping and
frontend/src/lib/sanitize.ts for the {@html} paths that render user
content. CSP still blocks remote scripts (no https: in script-src),
framing (frame-ancestors 'none'), base-uri hijacking, and form
exfiltration.

packages/server/src/notify_bridge_server/main.py

@@ -163,7 +163,12 @@ _CSP = (
     "default-src 'self'; "
     "img-src 'self' data: blob: https:; "
     "style-src 'self' 'unsafe-inline'; "
-    "script-src 'self'; "
+    # SvelteKit's static adapter emits an inline bootstrap <script> with the
+    # hydration payload, so 'self' alone blocks the SPA from starting.
+    # 'unsafe-inline' re-enables it; the app's primary XSS protection still
+    # comes from Svelte's template auto-escaping and frontend/sanitize.ts
+    # for the few {@html} paths that render user-controlled content.
+    "script-src 'self' 'unsafe-inline'; "
     "connect-src 'self'; "
     "font-src 'self' data:; "
     "base-uri 'self'; "