CSP: allow Ko-fi widget, Cloudflare Insights beacon and Truth for Life styles; v2.36.3

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

server.js

@@ -96,8 +96,8 @@ app.use((_req, res, next) => {
     'Content-Security-Policy',
     [
       "default-src 'self'",
-      "script-src 'self' 'unsafe-inline' https://www.truthforlife.org https://ajax.googleapis.com",
-      "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+      "script-src 'self' 'unsafe-inline' https://www.truthforlife.org https://ajax.googleapis.com https://storage.ko-fi.com https://static.cloudflareinsights.com",
+      "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://www.truthforlife.org",
       "font-src 'self' https://fonts.gstatic.com",
       "img-src 'self' data: https:",
       "media-src 'self' https:",