Fix: CSP connect-src for jsdelivr + better create author error display

app/middleware/security_headers.py

@@ -39,7 +39,7 @@ class SecurityHeadersMiddleware:
                      b"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
                      b"font-src 'self' https://fonts.gstatic.com; "
                      b"img-src 'self' data: https:; "
-                     b"connect-src 'self' https://api.openai.com; "
+                     b"connect-src 'self' https://api.openai.com https://cdn.jsdelivr.net; "
                      b"frame-ancestors 'none'"),
                 ]
                 if use_hsts:

app/superadmin/templates/superadmin.html

@@ -682,7 +682,10 @@ async function executeCreateAuthor() {
     toast(msg, 'success');
     loadAuthors();
     loadOverview();
-  } catch(e) { toast(e.message || 'Failed to create author', 'error'); }
+  } catch(e) {
+    console.error('Create author error:', e);
+    toast(e.message || 'Failed to create author', 'error');
+  }
 }
 
 /* SUBSCRIPTIONS — now powered by /super/grants */