fix: A20 (partiel) — CSP nonce par requête, unsafe-inline sort de script-src (v7.7.0)

- ContentSecurityPolicyMiddleware : nonce aléatoire par requête dans la
  ContextVar `CSP_NONCE` (posée avant `call_next` → visible des templates),
  `script-src 'self' 'unsafe-eval' 'nonce-…'` — plus aucun script inline
  sans nonce ne tourne (fin des XSS injectés en JS)
- 38 tags `<script>` des templates : `nonce="{{ csp_nonce() }}"` (passage
  scripté, vérifié : 0 restant) ; `LOCAL_LOGIN_HTML` (constante de module) :
  helper `_with_nonce()` au rendu ; collections.py : 3 scripts Python
  (chart/form/map) noncés
- `<meta name="htmx-config" content='{"inlineScriptNonce": …}'>` dans base.html
  : htmx ré-injecte les <script> des réponses boostées avec le bon nonce
- `script-src-attr 'unsafe-inline'` : les 74 handlers `onclick=` inline
  restent couverts (le nonce les aurait désactivés aussi)
- chart.js (cdn.jsdelivr.net) et leaflet (unpkg) ajoutés à script-src/style-src
  : vues chart/map déjà BLOQUÉES par la CSP depuis toujours
  (commentaire ponytail: upgrade = vendoriser puis retirer les hôtes)
- reste d'A20 : unsafe-eval (Alpine x-data → @alpinejs/csp), externalisation
  JS (A27), resserrer img-src/connect-src

test : test_csp_nonce_per_request (page base.html + page hors template,
nonce unique par requête)

suite **1037/1037** · `ruff check app tests` OK · docs à jour

app/templates/_ctx_menu.html

@@ -15,7 +15,7 @@
     open, openTab, peek, folder, rename, setIcon, duplicate, link, download,
     copyContent, move, fav, recent, delete, tagExisting, tagAdd, tagRemove
   ############################################################################}
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 /* ═════════════════════════════════════════════════════════════════════
    fdCtx — store Alpine UNIQUE du menu contextuel partagé.
    Enregistré dans 'alpine:init' avec garde d'exécution : que la page

app/templates/_database_table_scripts.html

@@ -106,7 +106,7 @@
 .db-list-title{flex:1;min-width:120px}
 .db-list-cell{color:var(--text-secondary);font-size:12px;min-width:110px}
 </style>
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 (function() {
     'use strict';
 

app/templates/_header.html

@@ -47,7 +47,7 @@
   </button>
   {% endif %}
 
-  <script type="application/json" id="fd-breadcrumb-data">{{ {"workspace_id": nav_workspace_id|default(0), "crumbs": ns.items}|tojson }}</script>
+  <script type="application/json" id="fd-breadcrumb-data" nonce="{{ csp_nonce() }}">{{ {"workspace_id": nav_workspace_id|default(0), "crumbs": ns.items}|tojson }}</script>
 
   <div class="topbar-left header-breadcrumb" x-data="fdBreadcrumb()" x-init="init()"
        @mouseleave="dragCloseTimer()">
@@ -142,7 +142,7 @@
   </div>
 </header>
 
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 document.addEventListener('alpine:init', function () {
   if (window.Alpine && window.Alpine.__fdBreadcrumbRegistered) return;
   if (window.Alpine) window.Alpine.__fdBreadcrumbRegistered = true;

app/templates/_icon_picker.html

@@ -10,7 +10,7 @@
   ############################################################################}
 {% set picker_icons = ['folder','file','calendar','clock','star','bot','users','globe','lock','book','check-square','trash','help-circle','settings','refresh','log-out','message-square','home','search','link','plus','bell','image','download','list','bar-chart','grid','align-left','corner-down-right','copy','key','inbox','edit','eye','share','x','paperclip','external-link','sparkles','lightbulb','tag','file-text','save','upload','trending-up','zap','alert-triangle','user'] %}
 
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 /* Global JS mirror of _icons.html + helpers to render emoji / icon / custom-emoji URLs. */
 (function () {
   var FD_ICONS = {
@@ -89,7 +89,7 @@
 })();
 </script>
 
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 (function () {
   if (window.__fdIconPickerRegistered) return;
   window.__fdIconPickerRegistered = true;

app/templates/_notification_bell.html

@@ -61,7 +61,7 @@
   </div>
 </span>
 
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 document.addEventListener('alpine:init', function () {
   if (window.Alpine && window.Alpine.__fdNotificationsRegistered) return;
   if (window.Alpine) window.Alpine.__fdNotificationsRegistered = true;

app/templates/_page_editor_realtime.html

@@ -9,7 +9,7 @@
 .rt-cursor .rt-cursor-name{position:absolute;top:-14px;left:4px;white-space:nowrap;font-size:9px;line-height:12px;padding:0 4px;border-radius:4px;color:#fff;font-weight:600;letter-spacing:.2px;}
 .rt-offline{font-size:11px;color:var(--text-tertiary,#999);margin-right:6px;display:none;}
 </style>
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 /* eslint-disable */
 /* ═══════════ v5.13.0 Realtime — WS gateway, présence, curseurs, merge LWW ═══════════ */
 window.__fdRT = (function () {

app/templates/_page_editor_scripts.html

@@ -1,7 +1,7 @@
-<script type="application/json" id="page-data">
+<script type="application/json" id="page-data" nonce="{{ csp_nonce() }}">
     {{ page_data | tojson }}
 </script>
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 /* eslint-disable */
 if (!window.__fdEditorScriptsLoaded) {
 window.__fdEditorScriptsLoaded = true;

app/templates/accounts.html

@@ -104,7 +104,7 @@
 {% endblock %}
 
 {% block scripts %}
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
   function accountsData() {
     return {
       profile: { full_name: '', email: '' },

app/templates/agent_panel.html

@@ -204,7 +204,7 @@
 </style>
 
 {# ── Global Agent API (available before Alpine for the FAB / shortcut) ── #}
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 (function(){
   var defaultAPI = {
     open: function(){ document.dispatchEvent(new CustomEvent('fd-agent-toggle')); },
@@ -456,7 +456,7 @@
   </div>
 </div>
 
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 (function(){
   // ── Skills intégrés (workflows « / ») et commandes admin du panneau ──
   var FD_ADMIN_CMDS = [

app/templates/base.html

@@ -113,6 +113,9 @@
     body.embed-mode .page-editor-wrapper { padding: 8px 16px !important; max-width: 100% !important; }
     body.embed-mode .page-cover-area { padding-top: 0 !important; }
   </style>
+  {# A20 : htmx copie les <script nonce="{{ csp_nonce() }}"> des réponses boostées — il remet leur nonce
+     depuis cette config (le nonce de la réponse courante, pas celui du fetch). #}
+  <meta name="htmx-config" content='{"inlineScriptNonce": "{{ csp_nonce() }}"}'>
   <script src="/static/js/htmx.min.js" data-cfasync="false"></script>
   <script src="/static/js/alpine.min.js" defer data-cfasync="false"></script>
   <script src="/static/js/sortable.min.js" defer data-cfasync="false"></script>
@@ -790,7 +793,7 @@
 
 </div>
 
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
   // Inject CSRF token into HTMX headers
   (function() {
     const getCsrf = () => {
@@ -2207,7 +2210,7 @@
     </div>
   </div>
 </div>
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 (function(){
   var PALETTE_ACTIONS = [
     { id:'new-page', icon:'📄', title:'New page', sub:'Create a new page in the current workspace', key:'Ctrl N', run:function(){ return window.FlowDeck && window.FlowDeck.createPage ? (window.FlowDeck.createPage(), true) : false; } },
@@ -2378,7 +2381,7 @@
 
 {# ─── PWA: offline client module + service worker registration (v6.0.0) ─── #}
 <script src="/static/js/offline.js?v={{ asset_version }}" defer data-cfasync="false"></script>
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 (function() {
   if (!('serviceWorker' in navigator)) return;
   window.addEventListener('load', function() {
@@ -2392,7 +2395,7 @@
 </script>
 
 {# ─── PWA: sync badge + toasts wiring (v6.0.0) ─── #}
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 document.addEventListener('DOMContentLoaded', function() {
   if (!window.FlowOffline) return;
   window.FlowOffline.onChange(function(s) {

app/templates/board.html

@@ -151,7 +151,7 @@
 {% endblock %}
 
 {% block scripts %}
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
   var owner = '{{ owner }}';
   var repo = '{{ repo }}';
   var initialView = '{{ initial_view }}';

app/templates/board_fragment.html

@@ -49,7 +49,7 @@
   {% endfor %}
 </div>
 
-<script>
+<script nonce="{{ csp_nonce() }}">
   function openCardDetail(id) {
     htmx.ajax('GET', `/api/issues/${owner}/${repo}/${id}?format=html`, {
       target: '#card-modal-content', swap: 'innerHTML'

app/templates/card_detail.html

@@ -98,7 +98,7 @@
   </div>
 </div>
 
-<script>
+<script nonce="{{ csp_nonce() }}">
   // ponytail: CSRF helper
   function getCsrf() {
     const m = document.cookie.match(/csrf_token=([^;]+)/);

app/templates/detailed_board.html

@@ -58,7 +58,7 @@
   {% endfor %}
 </div>
 
-<script>
+<script nonce="{{ csp_nonce() }}">
   function openCardDetail(id) {
     htmx.ajax('GET', `/api/issues/${owner}/${repo}/${id}?format=html`, {
       target: '#card-modal-content', swap: 'innerHTML'

app/templates/gitea_workspace.html

@@ -35,7 +35,7 @@
 .gw-content pre[class*="language-"]{background:var(--bg-tertiary)!important;border:1px solid var(--border)!important;border-radius:8px!important;padding:16px!important;}
 </style>
 
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 document.addEventListener('alpine:init', () => {
   Alpine.data('giteaWorkspace', () => {
   const params = new URLSearchParams(window.location.search);

app/templates/import.html

@@ -210,7 +210,7 @@ select,input[type=text]{background:var(--bg3);color:var(--text);border:1px solid
   </div>
 </div>
 
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 function importWizard() {
   return {
     sources: [],

app/templates/landing.html

@@ -206,7 +206,7 @@
   FlowDeck v4.0.1 — Open source · Self-hosted · Notion-compatible
 </footer>
 
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 (function() {
   if (!('serviceWorker' in navigator)) return;
   window.addEventListener('load', function() {

app/templates/library.html

@@ -456,7 +456,7 @@
 {% endblock %}
 
 {% block scripts %}
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 function libraryPage() {
   return {
     tab: 'recents',

app/templates/local_workspace.html

@@ -480,7 +480,7 @@
 .preview-leave-end{transform:translateX(100%);opacity:0;}
 </style>
 
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 console.log('FLOWDECK v2.4.6 — IIFE running, about to set _wsInitData');
 window._wsInitData = (function() {
   return {
@@ -2512,7 +2512,7 @@ for (var _i = 0; _i < _wsKeys.length; _i++) {
 _wsInitData = window._wsInitData;
 console.log('FLOWDECK v2.4.6 — IIFE done, _wsInitData keys:', Object.keys(window._wsInitData).length);
 </script>
-<script data-cfasync="false">console.log('FLOWDECK v2.4.6 — ws-split about to render, _wsInitData exists:', typeof window._wsInitData !== 'undefined');</script>
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">console.log('FLOWDECK v2.4.6 — ws-split about to render, _wsInitData exists:', typeof window._wsInitData !== 'undefined');</script>
 
 <div class="ws-split"
      @contextmenu.prevent="_wsInitData.onContextMenu($event)"

app/templates/page_editor_collection.html

@@ -7,7 +7,7 @@ page_title %}{{ page.title }}{% endblock %} {% block topbar %}
 {% endblock %} {% block content %}
 {% include "_database_table.html" %}
 {% endblock %} {% block scripts %}
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
     // Initialize database table from server-rendered data
     window.__DB_PAGE_ID = {{ page.id }};
     window.__DB_COLLECTION_ID = {{ page.collection_id or 0 }};

app/templates/page_editor_embed.html

@@ -4,7 +4,7 @@
 {% block topbar %}{% endblock %}
 {% block content %}
 {% include '_page_editor_content.html' %}
-<script data-cfasync="false">document.body.classList.add('embed-mode');</script>
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">document.body.classList.add('embed-mode');</script>
 {% endblock %}
 {% block scripts %}
 {% include '_page_editor_scripts.html' %}

app/templates/public_page.html

@@ -173,7 +173,7 @@
 </footer>
 
 <script src="/static/js/katex.min.js?v=0.16.11"></script>
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 document.addEventListener('DOMContentLoaded', function () {
   if (window.katex) {
     document.querySelectorAll('div[data-katex]').forEach(function (el) {

app/templates/settings.html

@@ -1191,7 +1191,7 @@
   </div>
 </div>
 
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 function settingsInit() {
   return {
     activeSection: 'account',

app/templates/table_view.html

@@ -99,7 +99,7 @@
   </div>
 </div>
 
-<script>
+<script nonce="{{ csp_nonce() }}">
   function tableView() {
     return {
       sortField: '',

app/templates/team_load.html

@@ -43,7 +43,7 @@
   <div class="legend-item"><span class="legend-dot" style="background:var(--green);"></span> Complete</div>
 </div>
 
-<script>
+<script nonce="{{ csp_nonce() }}">
   function teamLoad() {
     return {};
   }

app/templates/trash.html

@@ -62,7 +62,7 @@
 {% endblock %}
 
 {% block scripts %}
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
   function trashData() {
     return {
       search: '',

app/templates/welcome.html

@@ -133,7 +133,7 @@ h1{font-size:22px;font-weight:700;margin-bottom:6px;}
     </section>
   </div>
 
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 function onboarding() {
   return {
     steps: ['Bienvenue', 'Espace de travail', 'Connecter une forge', 'Premier projet'],

app/templates/workspace.html

@@ -140,7 +140,7 @@
 
 </div>
 
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 function workspacePage() {
   return {
     builtinProjects: [],

app/templates/workspaces.html

@@ -172,7 +172,7 @@
 
 </div>
 
-<script data-cfasync="false">
+<script data-cfasync="false" nonce="{{ csp_nonce() }}">
 function workspacesPage() {
   return {
     workspaces: [],