e678e21ee8
script-src had no allowance for cdn.jsdelivr.net, which is where the Scalar API-reference viewer's JS is loaded from — the script itself never ran. Added it to script-src/style-src/font-src/connect-src. (User-confirmed before applying — widens what's allowed to load, so wanted explicit sign-off rather than just doing it in response to a console error.)