fix: disable Zod JIT in App so Views run under strict CSP

Zod v4's object parser compiles a fast path with new Function(), which
violates script-src CSP without unsafe-eval. Hosts that enforce the
spec's default CSP (e.g. VS Code) cannot load any View that parses an
incoming message.

Set z.config({ jitless: true }) at the top of the App entry so the
interpreter path is used instead. Applies to every View bundle, not
just map-server.

Addresses #374. Relevant to #199.

Author: ochafik

src/app.ts

@@ -60,6 +60,11 @@ import {
   McpUiRequestDisplayModeResultSchema,
 } from "./types";
 import { Transport } from "@modelcontextprotocol/sdk/shared/transport.js";
+import { z } from "zod/v4";
+
+// Disable Zod's JIT compiler (which uses `new Function()`) so Views can run
+// under a strict CSP without `unsafe-eval`. See #374, #199, zod#4461.
+z.config({ jitless: true });
 
 export { PostMessageTransport } from "./message-transport";
 export * from "./types";