docs(security): document why CSP is drafted but not yet enforced

Enforcing it blanked the whole app in production (ClerkProvider wraps
the tree in layout.tsx; a blocked resource during Clerk's client init
throws uncaught). Adding wss://clerk.pawfeed.org to connect-src did not
fix it. Next attempt: ship as Content-Security-Policy-Report-Only first
to see real violation reports before enforcing again. All other
security headers (HSTS, X-Frame-Options, etc.) and rate limiting stay
active and are unaffected.

next.config.ts

@@ -11,6 +11,15 @@ function getSupabaseHostname(): string {
   return "*.supabase.co";
 }
 
+// Drafted but NOT wired into headers() yet — enabling it blanked the entire
+// app (ClerkProvider wraps the whole tree in layout.tsx; a blocked resource
+// during its client-side init throws, and nothing catches it, so the app
+// crashes to a blank page instead of just breaking the login widget).
+// Confirmed live on 2026-08-10 that disabling this CSP fixes it; adding
+// wss://clerk.pawfeed.org to connect-src did NOT fix it, so the real blocked
+// directive is still unidentified. Next attempt should ship as
+// Content-Security-Policy-Report-Only first (with a /api/csp-report endpoint)
+// to see actual violation reports before enforcing on production again.
 function buildCsp(): string {
   const supabase = `https://${getSupabaseHostname()}`;
   const directives: Record<string, string[]> = {