fix: serve scripts from /static (were 404) + bundle three.js locally — 3D now renders

static/index.html

@@ -237,15 +237,15 @@
 </div>
 <div class="toast" id="toast"></div>
 
-<script src="https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js"></script>
+<!-- Three.js is bundled LOCALLY and served from /static so no CDN/CSP can block it. -->
+<script src="/static/three.min.js"></script>
 <script>
-// Robust loader: if the primary CDN is blocked, fall back to unpkg before
-// loading app.js — guarantees the 3D scene never silently fails to boot.
+// Load the app only once THREE is guaranteed. Local first; CDN only as a last resort.
 (function(){
-  function loadApp(){ var s=document.createElement('script'); s.src='app.js?v=2'; document.body.appendChild(s); }
+  function loadApp(){ var s=document.createElement('script'); s.src='/static/app.js?v=3'; document.body.appendChild(s); }
   if(window.THREE){ loadApp(); return; }
   var f=document.createElement('script');
-  f.src='https://unpkg.com/three@0.128.0/build/three.min.js';
+  f.src='https://cdnjs.cloudflare.com/ajax/libs/three.js/r128/three.min.js';
   f.onload=loadApp; f.onerror=loadApp;
   document.body.appendChild(f);
 })();