fix: allow inline style= attributes via CSP style-src-attr

Timing bars in the status panel and any other dynamically-injected
style= attributes were being silently blocked by the Content Security
Policy. style-src only governs <style> blocks and linked stylesheets;
inline element attributes need style-src-attr separately.

Adding style-src-attr 'unsafe-inline' is the minimal fix — it only
affects attribute-level inline styles, not script execution.

Also removes the temporary debug console.log added in the previous commit.

server/app.js

@@ -42,6 +42,7 @@ function createApp({ skipRateLimits = false } = {}) {
           defaultSrc: ["'self'"],
           scriptSrc: ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
           styleSrc: ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
+          styleSrcAttr: ["'unsafe-inline'"],
           imgSrc: ["'self'", 'data:', 'blob:'],
           fontSrc: ["'self'", 'data:'],
           connectSrc: ["'self'"],