fix(csp): Add nonce to style tag for CSP compliance

The <style> tag in viewer.html was being blocked by CSP after removing
'unsafe-inline' from style-src. This caused the entire UI to render
without any styling.

Fix:
- Add nonce="<!--NONCE-->" attribute to <style> tag in viewer.html
- Add nonce to styleSrc CSP directive in editorController.ts
- Update CLAUDE.md to reflect nonce-based style policy

The nonce placeholder is replaced at runtime with the same nonce used
for scripts, allowing the inline <style> block to pass CSP validation.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: zknpr

CLAUDE.md

@@ -141,7 +141,7 @@ workerProxy.method(new Transfer(data, [data.buffer]));
 
 ### Content Security Policy (CSP)
 - **Scripts**: Strict nonce-based policy. No `'unsafe-inline'` allowed.
-- **Styles**: No `'unsafe-inline'` allowed. Dynamic inline styles are applied via CSSOM (`element.style.prop = ...`) which is permitted by CSP with `'self'`.
+- **Styles**: Nonce-based policy for `<style>` tags. Dynamic inline styles are applied via CSSOM (`element.style.prop = ...`) which is permitted by CSP.
 - **Isolation**: Webview communicates only via RPC.
 
 ### Cross-Site Scripting (XSS) Prevention

core/ui/viewer.template.html

@@ -5,7 +5,7 @@
     <meta name="viewport" content="width=device-width, initial-scale=1.0">
     <title>SQLite Explorer</title>
     <!--HEAD-->
-    <style>
+    <style nonce="<!--NONCE-->">
 <!--STYLES-->
     </style>
 </head>

src/editorController.ts

@@ -231,10 +231,11 @@ export class DatabaseViewerProvider extends Disposable implements vsc.CustomRead
       // wasm-unsafe-eval is still required for sql.js WASM compilation.
       //
       // NOTE: 'unsafe-inline' for styles has been removed.
+      // The <style> tag in viewer.html uses a nonce for CSP compliance.
       // Dynamic inline styles for column widths and positioning are handled via
-      // CSSOM (element.style.prop = ...) which is allowed by CSP 'self'.
+      // CSSOM (element.style.prop = ...) which is allowed by CSP.
       [cspUtil.scriptSrc]: [webview.cspSource, cspUtil.wasmUnsafeEval, `'nonce-${nonce}'`],
-      [cspUtil.styleSrc]: [webview.cspSource],
+      [cspUtil.styleSrc]: [webview.cspSource, `'nonce-${nonce}'`],
       [cspUtil.imgSrc]: [webview.cspSource, cspUtil.data, cspUtil.blob],
       [cspUtil.fontSrc]: [webview.cspSource],
       [cspUtil.frameSrc]: [cspUtil.none],