fix: allow HuggingFace Spaces iframe embedding (cookies, CSP, CSRF)

fix: remove CSP nonce from style-src to unblock reagraph canvas (#425)

fix(auth): fix HTTP/Tailscale login — opt-in HTTPS redirect, CSP nonce propagation