fix(csp): resolves Content Security Policy violations + enables Worker observability

[wgordon17]

Summary

• Splits style-src into style-src-elem + style-src-attr (CSP Level 3) to allow Kobalte/corvu inline style attributes while blocking style tag injection
• Adds data: to img-src for daisyUI SVG data URIs in CSS mask-image, excludes unused components (chat, mask, mockup)
• Refactors all app-level inline styles to Tailwind classes and CSS custom properties to eliminate our own CSP violations