Security hardening regressions

A strict CSP killed one form in production, and every monitor stayed green

A per-request nonce met a statically prerendered page, and the browser refused every script it was sent. Six health signals, including a 3,500-test suite, reported fine.