Allow dark mode theme script via CSP hash

The inline script in app.html that applies the dark mode class before
paint is not covered by SvelteKit's nonce system. Whitelist it by
its SHA-256 hash instead.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

svelte.config.js

@@ -12,7 +12,7 @@ const config = {
 		csp: {
 			directives: {
 				'default-src': ['self'],
-				'script-src': ['self']
+				'script-src': ['self', 'sha256-PDIMa2Wg+qyPaCjQ/EcSk+qN0Ftomecz3B0NZzZHivs=']
 			}
 		}
 	}