Say what a strict content-security-policy has to allow

[zopeVaibhav]

What this changes

The review on #204 asked for this: the inline theme script in app/index.html is correct as
shipped, but a deployment that puts a strict content-security-policy in front of it has to allow
that script, and nothing said so.

One paragraph in docs/deployment.md under Known costs, which is already where the traps that are
not visible from the code live. It names what actually breaks — script-src blocks the script, the
pre-paint decision never runs, and the flash #204 removed comes back on the first frame — and names
the 'sha256-' hash as the form that survives a rebuild without a per-request nonce.

Where it runs

Documentation. No code ships.

• New state that outlives a request? None.
• What happens on the second replica? Nothing. No code changed.
• Anything serialised? None.
• Anything fanned out to a browser? None.
• New listener, port, or schedule? None.

Boundary and audit

• No acting call is added or changed.
• No new refusal or failure path.
• Nothing new is trusted from the client.

Changelog

No line. A deployment behaves no differently afterwards: this adds a paragraph to
docs/deployment.md and ships nothing that runs.

Proof

bunx biome format . and bunx biome lint --error-on-warnings . both clean. Added lines wrap at
100 columns, matching the file. No source file is touched, so the app and gateway suites are
unaffected by this diff.