bug: CSP img-src 'self' data: blocks GitHub avatars on the profile page

[ionfwsrijan]

Summary

GitHub avatar images on the profile page are blocked by the site's Content-Security-Policy. The CSP sets img-src 'self' data: (app.py:133), and profile.html renders {{ user.avatar_url }} — which is https://avatars.githubusercontent.com/... for GitHub-authenticated users — so the avatar never loads.

Evidence

src/app.py:129-133 (header added to all responses):

response.headers["Content-Security-Policy"] = (
    ...
    "img-src 'self' data:; "
    ...
)

src/templates/profile.html:148-149:

{% if user.avatar_url %}
<img src="{{ user.avatar_url }}" alt="{{ user.username }}'s avatar" class="profile-avatar">

avatar_url originates from the GitHub OAuth profile (https://avatars.githubusercontent.com/u/<id>), which the CSP does not whitelist (img-src allows only 'self' and data:).

Impact

• Profile avatars for GitHub logins are broken (browser blocks the request).
• Inconsistent with the known CSP issues already tracked ([GSSoC '26] Bug: Strict CSP blocking Google Fonts and Lenis Script #1038/[Bug]: GitHub skill import fails due to Content Security Policy (CSP) blocking api.github.com #1039) — those cover fonts/scripts and the API, not img-src for avatars.

Suggested Fix

Add GitHub avatar hosts to img-src, e.g. img-src 'self' data: https://avatars.githubusercontent.com https://*.githubusercontent.com, and verify the profile page avatar renders under the updated policy.