fix: allow inline style= attributes via CSP style-src-attr

Timing bars in the status panel and any other dynamically-injected
style= attributes were being silently blocked by the Content Security
Policy. style-src only governs <style> blocks and linked stylesheets;
inline element attributes need style-src-attr separately.

Adding style-src-attr 'unsafe-inline' is the minimal fix — it only
affects attribute-level inline styles, not script execution.

Also removes the temporary debug console.log added in the previous commit.

public/app.js

@@ -705,7 +705,6 @@ function renderStatusPanel(data, panel) {
         <div class="status-card-title">Last Poll (${lp.totalMs}ms total, ${pollAge}s ago)</div>
         <div class="status-timings">`;
     const maxTaskMs = lp.tasks.reduce((max, t) => Math.max(max, t.ms), 1);
-    console.log('[Status] task timings:', JSON.stringify(lp.tasks), 'maxTaskMs:', maxTaskMs);
     for (const t of lp.tasks) {
       const barWidth = Math.max(2, (t.ms / maxTaskMs) * 100);
       html += `

server/app.js

@@ -42,6 +42,7 @@ function createApp({ skipRateLimits = false } = {}) {
           defaultSrc: ["'self'"],
           scriptSrc: ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
           styleSrc: ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
+          styleSrcAttr: ["'unsafe-inline'"],
           imgSrc: ["'self'", 'data:', 'blob:'],
           fontSrc: ["'self'", 'data:'],
           connectSrc: ["'self'"],