fix: allow inline style= attributes via CSP style-src-attr

Timing bars in the status panel and any other dynamically-injected
style= attributes were being silently blocked by the Content Security
Policy. style-src only governs <style> blocks and linked stylesheets;
inline element attributes need style-src-attr separately.

Adding style-src-attr 'unsafe-inline' is the minimal fix — it only
affects attribute-level inline styles, not script execution.

Also removes the temporary debug console.log added in the previous commit.

public/app.js

@@ -705,7 +705,6 @@ function renderStatusPanel(data, panel) {
         <div class="status-card-title">Last Poll (${lp.totalMs}ms total, ${pollAge}s ago)</div>
         <div class="status-timings">`;
     const maxTaskMs = lp.tasks.reduce((max, t) => Math.max(max, t.ms), 1);
-    console.log('[Status] task timings:', JSON.stringify(lp.tasks), 'maxTaskMs:', maxTaskMs);
     for (const t of lp.tasks) {
       const barWidth = Math.max(2, (t.ms / maxTaskMs) * 100);
       html += `