fix: allow next inline scripts in csp

next.config.ts

@@ -40,8 +40,8 @@ const nextConfig: NextConfig = {
     const isDev = process.env.NODE_ENV === "development";
     const csp = [
       "default-src 'self'",
-      // Next.js 需要 unsafe-eval 用于开发模式 (Fast Refresh / Turbopack)
-      `script-src 'self'${isDev ? " 'unsafe-eval'" : ""}`,
+      // Next.js App Router/RSC emits inline bootstrap scripts in production.
+      `script-src 'self' 'unsafe-inline'${isDev ? " 'unsafe-eval'" : ""}`,
       // Next.js 需要 unsafe-inline 用于样式 (CSS-in-JS / Tailwind)
       "style-src 'self' 'unsafe-inline'",
       "img-src 'self' data: blob: https: http:",