Resolve unresolved merge conflict markers left in main

The merge of claude/nifty-bhaskara-fb3ec2 left three-way conflict
markers committed straight into index.html, _headers, and
.claude/launch.json instead of being resolved. Two branches had
independently fixed the same duplicate-CSP bug; keep the more
thorough fix (single CSP source of truth in _headers, no meta tag
in index.html, local photo path) and drop the now-unneeded
'unsafe-inline'/ki5bhv.com allowances.

.claude/launch.json

@@ -3,11 +3,7 @@
   "configurations": [
     {
       "name": "static-site",
-<<<<<<< HEAD
-      "runtimeExecutable": "C:\\Users\\justi\\AppData\\Local\\Programs\\Python\\Python312\\python.exe",
-=======
       "runtimeExecutable": "python",
->>>>>>> 6cea0312d23f660964b44ad3b2a6f18619d0b10b
       "runtimeArgs": ["-m", "http.server", "8123"],
       "port": 8123
     }