Content-Security-Policy: default-src 'self';  script-src 'self' 'unsafe-eval' 'unsafe-inline' *.vercel-analytics.com *.vercel-scripts.com *.cloudflareinsights.com https://apis.google.com https://*.googleapis.com https://*.gstatic.com https://accounts.google.com https://www.googletagmanager.com;  style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://accounts.google.com;  img-src *.supabase.co * blob: data:;  media-src *.s3.amazonaws.com *.shipixen.com;  frame-src 'self' https://www.youtube.com https://www.youtube-nocookie.com https://accounts.google.com https://tv-watch-list-5a288.firebaseapp.com;  connect-src * https://*.googleapis.com https://accounts.google.com;  font-src 'self' https://fonts.gstatic.com;