below — see vite.config.ts for the full policy and reasoning, and
`app/static/_headers` for the real HTTP header Cloudflare Pages serves in production
(kept in sync with the per-build hashes by scripts/patch-csp-headers.mjs, a postbuild
step, so the two don't silently disagree and break the deployed app).
-->
%sveltekit.head%