Align auth response CSP and add Strava sign-in fallback

[Copilot]

The “Connect with Strava” flow fails with CSP blocking inline script execution, followed by a client-side error from missing auth navigation. This PR makes dynamic auth responses honor the same CSP as static pages and provides a reliable, keyboard-accessible sign-in fallback.

• CSP parity for auth responses
  • Add security headers in the server hook and centralize the CSP string so auth routes receive the same policy as static assets.
• Strava connect fallback
  • Replace the click-only button with a form submit fallback that still invokes signIn('strava') when JS is available.

<form action="/auth/signin/strava" method="get" on:submit|preventDefault={() => signIn('strava')}>
	<button type="submit" class="...">...</button>
</form>

[Copilot]

Pull request overview

This PR updates the Strava authentication flow by applying security headers to dynamic server responses and adding a non-JavaScript form fallback for connecting with Strava.

Changes:

• Adds a SvelteKit server hook to set security headers, including CSP, on resolved responses.
• Composes the new security-header hook with the existing Auth.js handler.
• Replaces the click-only Strava button with a form-backed submit button that still calls signIn('strava') when JavaScript is available.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
src/hooks.server.ts	Adds CSP and other security headers to dynamic responses while preserving auth handling.
src/lib/components/sidebar/ConnectPanel.svelte	Adds a form-based Strava sign-in fallback around the existing client-side sign-in behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.