Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://fonts.googleapis.com https://cdn.jsdelivr.net https://api.mapbox.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://api.mapbox.com; font-src https://fonts.gstatic.com https://api.mapbox.com; img-src 'self' https://storage.googleapis.com https://*.supabase.co https://*.cdninstagram.com https://*.fbcdn.net https://scontent.cdninstagram.com https://api.mapbox.com data: blob:; connect-src 'self' https://edgnudrbysybefbqyijq.supabase.co https://www.strava.com https://generativelanguage.googleapis.com https://api.openai.com https://api.anthropic.com https://api.mapbox.com https://*.mapbox.com; media-src 'self' blob:; frame-src 'self' https://api.mapbox.com; worker-src 'self' blob:;