fix(desktop): externalize boot <style> to prevent Tauri CSP nonce override

desktop/index.html

@@ -12,6 +12,10 @@
       in tauri.conf.json. The body paints its own themed background once the app
       CSS loads, so this never shows through after boot.
 
+      The linked stylesheet (boot.css) applies the initial black background.
+      Kept as a <link> rather than an inline <style> to avoid Tauri's nonce
+      injection for style-src (see boot.css for the full rationale).
+
       The inline script below reads the cached theme background (same
       `buzz-theme-cache` entry ThemeProvider writes) and applies it synchronously
       so the boot color matches the themed loading gate — no black flash on light
@@ -20,11 +24,7 @@
       that ThemeProvider applies moments later — no wrong-scheme flash before
       it loads.
     -->
-    <style>
-      html {
-        background-color: #000;
-      }
-    </style>
+    <link rel="stylesheet" href="/boot.css" />
     <script>
       (() => {
         var cached, bg, parsed;

desktop/public/boot.css

@@ -0,0 +1,18 @@
+/*
+ * Boot background — applied before the app bundle loads so the window never
+ * flashes an unstyled background on cold start. The inline script in
+ * index.html overwrites this with the cached theme color once ThemeProvider's
+ * state is available; on first-ever launch it falls back to this black default.
+ *
+ * Kept as a linked stylesheet (not an inline <style>) so that Tauri's
+ * build-time asset processing does not inject a nonce token into this element.
+ * Tauri nonces inline <style> elements and adds the corresponding 'nonce-…'
+ * source to style-src at runtime; per the CSP spec a nonce in a directive
+ * causes the browser to ignore 'unsafe-inline', which would block TipTap's
+ * runtime stylesheet injection and emoji-mart's shadow-root styles in packaged
+ * builds. The inline boot script is SHA-256 hashed (not nonced) — that path
+ * only applies to scripts, not stylesheets.
+ */
+html {
+  background-color: #000;
+}

desktop/src-tauri/tests/csp.rs

@@ -195,7 +195,10 @@ fn connect_src_allows_ipc_and_cleartext_relays() {
 fn script_src_stays_free_of_unsafe_inline_and_eval() {
     let allowed = sources("script-src");
     // The inline boot script in index.html is covered by Tauri's build-time
-    // sha256 hashing, so neither escape hatch is ever needed here.
+    // SHA-256 hashing (scripts only — Tauri nonces inline <style> elements via
+    // a different path), so neither escape hatch is ever needed here. The boot
+    // background style was moved to public/boot.css to avoid the nonce path for
+    // style-src; see boot.css for the full rationale.
     assert!(!allowed.contains(&"'unsafe-inline'".to_owned()));
     assert!(!allowed.contains(&"'unsafe-eval'".to_owned()));
 }