fix: allow embedded worker API requests

server/src/WebDrop.Frontend/EmbeddedFrontend.cs

@@ -87,7 +87,9 @@ public static class EmbeddedFrontend
             ? "public, max-age=31536000, immutable"
             : "no-store";
 
-        if (path.Equals("index.html", StringComparison.Ordinal))
+        // Dedicated workers enforce the CSP returned with their own script response.
+        // Give bundled JS the same app policy so the crypto worker can call the same-origin API.
+        if (path.Equals("index.html", StringComparison.Ordinal) || path.EndsWith(".js", StringComparison.OrdinalIgnoreCase))
             context.Response.Headers["Content-Security-Policy"] = contentSecurityPolicy;
 
         if (!HttpMethods.IsHead(context.Request.Method))