Function default_header_template 

pub fn default_header_template() -> &'static str

Note: CSP includes ‘unsafe-inline’ in style-src because embedded images in txt2html.rs use inline style attributes (style=“max-width:100%;height:auto”) for responsive sizing. script-src uses a sha256 hash of the fixed inline theme/a11y script instead of ‘unsafe-inline’, so injected <script> content anywhere else in the page (e.g. an unescaped subject) still gets blocked by the browser.