Gronod
cafa608e8c
Timing bars in the status panel and any other dynamically-injected style= attributes were being silently blocked by the Content Security Policy. style-src only governs <style> blocks and linked stylesheets; inline element attributes need style-src-attr separately. Adding style-src-attr 'unsafe-inline' is the minimal fix — it only affects attribute-level inline styles, not script execution. Also removes the temporary debug console.log added in the previous commit.