fix: allow Next hydration scripts under CSP

next.config.ts

@@ -25,15 +25,15 @@ const baseSecurityHeaders = [
 // so a content policy doesn't apply to them anyway. connect-src stays broad
 // because the WebRTC call pages connect to the separately hosted LiveKit SFU
 // at runtime. style-src needs
-// 'unsafe-inline' because framer-motion drives its animations through
-// inline style attributes. script-src allows 'unsafe-eval' only in dev,
-// matching Next's own documented CSP guidance — React uses eval there for
-// server-error-stack reconstruction; neither React nor Next use it in a
-// production build.
+// 'unsafe-inline' because Next App Router emits inline RSC flight/bootstrap
+// scripts that are required for hydration. script-src allows 'unsafe-eval'
+// only in dev, matching Next's own documented CSP guidance — React uses eval
+// there for server-error-stack reconstruction; neither React nor Next use it
+// in a production build.
 const isDev = process.env.NODE_ENV === "development";
 const frontendCSP = [
   "default-src 'self'",
-  `script-src 'self'${isDev ? " 'unsafe-eval'" : ""}`,
+  `script-src 'self' 'unsafe-inline'${isDev ? " 'unsafe-eval'" : ""}`,
   "style-src 'self' 'unsafe-inline'",
   "img-src 'self' data: blob:",
   "font-src 'self' data:",