fix: CSP script-src-attr:none blocked all onclick handlers since day 1

backend/server.js

@@ -42,6 +42,7 @@ app.use(helmet({
       imgSrc: ["'self'", "data:", "blob:"],
       mediaSrc: ["'self'"],
       connectSrc: ["'self'"],
+      scriptSrcAttr: null,
     },
   },
   crossOriginEmbedderPolicy: false,