Tighten CSP: remove inline styles + unused icon font (style-src & font-src → 'self')

[jansroka]

Tightens the Content-Security-Policy by removing the two things that forced loose directives, at the same time cleaning up the HTML/CSS.

style-src 'self' 'unsafe-inline' → style-src 'self'

Moved all 6 inline style= attributes into CSS classes:

• 5 per-project background tints on .projekt-block cards (projekte.html) → .projekt-block--{impfen,labhive,coronika,dw,did} in custom.css
• text-align: end on the letter date (offenerbrief-epa-2025.html) → .text-end

Colours/alignment are unchanged (verified byte-for-byte in the purged production CSS). Confirmed the built _site has zero inline style= attributes, <style> blocks, on*= handlers, or javascript: URIs — so nothing else needed the inline allowance.

font-src 'self' data: → font-src 'self'

The only thing requiring data: was an embedded webflow-icons @font-face (~2.6 KB base64 TTF data URI). That icon font is unused — no w-icon- class exists anywhere in source or the built site, and PurgeCSS already strips it from production. Removed the @font-face from webflow.css (the inert .w-icon-* rules are left as-is; they match nothing). All remaining fonts are the same-origin Inter webfont under /assets/fonts/.

Resulting CSP

default-src 'self'; img-src 'self' data:; style-src 'self'; font-src 'self';
object-src 'none'; base-uri 'self'; form-action 'self'

(img-src keeps data: — data-URI images still exist in the CSS.)

Verification

webflow.css braces balanced (valid), Inter fonts intact, no data: font in _site, project-card colours unchanged in purged CSS; jekyll build, purge-css, html-proofer, and prettier --check all pass. Updated memory/csp-policy.md to match.

Noted, not done (out of scope)

The 5 project logos in projekte.html have empty alt="" — an a11y gap (likely among the pa11y findings). Happy to fix in a follow-up.

🤖 Generated with Claude Code