fix: add 'unsafe-inline' to CSP script-src for token injection

The injected <script> tag that sets window.__OPENCLAW_AUTH_TOKEN__ was
blocked by CSP script-src 'self'. Without 'unsafe-inline', the inline
script never executes — so in incognito mode (no localStorage), the
token is never set and WebSocket auth fails.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

patches/hf-spaces-allow-iframe-embedding.patch

@@ -1,16 +1,18 @@
 diff --git a/src/gateway/control-ui-csp.ts b/src/gateway/control-ui-csp.ts
-index 8a7b56f..112b1c2 100644
+index 8a7b56f..62b0dfd 100644
 --- a/src/gateway/control-ui-csp.ts
 +++ b/src/gateway/control-ui-csp.ts
-@@ -7,7 +7,7 @@ export function buildControlUiCspHeader(): string {
+@@ -7,8 +7,8 @@ export function buildControlUiCspHeader(): string {
      "default-src 'self'",
      "base-uri 'none'",
      "object-src 'none'",
 -    "frame-ancestors 'none'",
+-    "script-src 'self'",
 +    "frame-ancestors 'self' https://huggingface.co https://*.hf.space",
-     "script-src 'self'",
++    "script-src 'self' 'unsafe-inline'",
      "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
      "img-src 'self' data: https:",
+     "font-src 'self' https://fonts.gstatic.com",
 diff --git a/src/gateway/control-ui.ts b/src/gateway/control-ui.ts
 index ed7b733..7cc0ab9 100644
 --- a/src/gateway/control-ui.ts