Strict Nonce-Based CSP

Per-request nonce Content-Security-Policy enforcement via middleware for safe inline JsonLd scripts without 'unsafe-inline' on script-src. Production enforcement (Path B) for Next.js 15 App Router + Fumadocs.