index.html carried two Content-Security-Policy meta tags that were
never reconciled, so browsers enforced their intersection: the
Cloudflare beacon script/connect endpoints, the profile photo from
ki5bhv.com, and the page's own inline script/onerror handler all got
silently blocked depending on which policy line was checked.
Collapse index.html down to a single correct policy, and add the
same static.cloudflareinsights.com / cloudflareinsights.com
allowances to _headers (the actual Cloudflare Pages response header)
and to k5bss.html's policy, since Cloudflare injects that beacon
site-wide.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Justin