chore: patch deps, CSP style nonces, otplib 13, and PR CI

Co-authored-by: Cursor <[email protected]>

src/components/theme-vars.tsx

@@ -9,7 +9,7 @@ import {
 
 // Injects the DB-driven CSS custom properties into :root / html.dark.
 // Readable (WCAG) text colors are derived centrally in themePaletteCss.
-export async function ThemeVars() {
+export async function ThemeVars({ nonce }: { nonce?: string } = {}) {
 	const g = (k: string, d: string) => siteSettings.get(k, d);
 	const [
 		primary,
@@ -175,10 +175,13 @@ export async function ThemeVars() {
 		return (
 			<>
 				{googleHref ? <link rel="stylesheet" href={googleHref} /> : null}
-				<style dangerouslySetInnerHTML={{ __html: css }} />
+				<style nonce={nonce} dangerouslySetInnerHTML={{ __html: css }} />
 				{customCss?.trim() ? (
 					// Staff-authored custom CSS (housekeeping → Theme). Trusted input.
-					<style dangerouslySetInnerHTML={{ __html: customCss }} />
+					<style
+						nonce={nonce}
+						dangerouslySetInnerHTML={{ __html: customCss }}
+					/>
 				) : null}
 			</>
 		);