fix: externalize hoisted scripts so CSP script-src 'self' allows them

Astro was inlining the theme/nav/observer bundle as <script type="module">.
The deployed nginx CSP blocks inline scripts, so the reveal observer never
ran and every [data-reveal] section stayed at opacity:0 (space reserved,
nothing visible). Force JS external via assetsInlineLimit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

site/astro.config.mjs

@@ -26,6 +26,10 @@ export default defineConfig({
   compressHTML: true,
   vite: {
     plugins: [tailwindcss()],
+    // Never inline JS: the deployed CSP is `script-src 'self'`, which blocks inline
+    // <script> modules. Keep hoisted scripts as external /_astro/*.js so CSP allows them.
+    // (Images etc. fall back to the default inline threshold.)
+    build: { assetsInlineLimit: (file) => (file.endsWith('.js') ? false : undefined) },
     resolve: {
       alias: {
         '@': r('./src'),