Merge origin/feature/N7Web into feature/N7Web

Integrate the remote firmware workbench, OTA delivery, and timed mode schedules while preserving the local N7 scene and runtime changes.

tests/unit/test_frontend_theme_contract.py

@@ -1,3 +1,5 @@
+import base64
+import hashlib
 import re
 from pathlib import Path
 
@@ -52,7 +54,7 @@ def test_theme_asset_versions_are_consistent_with_the_pwa_shell() -> None:
         assert source_asset in main
         assert f'"{cached_asset}"' in service_worker
     assert 'import "./styles/design-system.css"' in main
-    assert 'const CACHE_VERSION = "cognitive-agent-pad-v321-n7-dispatch"' in service_worker
+    assert 'const CACHE_VERSION = "cognitive-agent-pad-v322-n7-firmware-merge"' in service_worker
 
 
 def test_reference_glass_theme_covers_the_complete_workspace() -> None:
@@ -95,6 +97,21 @@ def test_reference_glass_theme_covers_the_complete_workspace() -> None:
     assert "border-radius: 0 !important" in theme
 
 
+def test_theme_bootstrap_is_allowed_by_csp_without_unsafe_inline() -> None:
+    html = (WEB / "index.html").read_text(encoding="utf-8")
+    inline_script = re.search(r"<script>(.*?)</script>", html, flags=re.DOTALL)
+    assert inline_script is not None
+    digest = base64.b64encode(
+        hashlib.sha256(inline_script.group(1).encode("utf-8")).digest()
+    ).decode("ascii")
+    server = (ROOT / "src" / "cognitive_agent" / "server.py").read_text(
+        encoding="utf-8"
+    )
+
+    assert f"'sha256-{digest}'" in server
+    assert "'unsafe-inline'" not in server
+
+
 def test_reference_theme_uses_one_transform_only_floating_card_contract() -> None:
     theme = source("codepen-glass-theme.css")