Bezbednosni audit i refaktoring: HP popravke, RBAC, flash poruke, go:embed, CSP

internal/middleware/bezbednost.go

@@ -14,7 +14,8 @@ func BezbednostHeaders() func(http.Handler) http.Handler {
 			h.Set("Content-Security-Policy",
 				"default-src 'self'; "+
 					"style-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com; "+
-					"script-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com https://cdn.jsdelivr.net; "+
+					// Alpine.js v3 koristi new Function() interno — unsafe-eval je neophodan; CSP build zahteva značajan refaktoring.
+				"script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.tailwindcss.com https://cdn.jsdelivr.net; "+
 					"img-src 'self' data: blob:; "+
 					"font-src 'self'; "+
 					"connect-src 'self'")