The forge pill shows on a page whose CSP admits scripts by nonce: the pill's tag carries the page's nonce #8210

A preview of lab answers script-src 'nonce-…' with no 'self' (see any preview, e.g. pull-8203), so even a same-origin pill is refused there. The proxy can read the nonce from the response's own Content-Security-Policy header.

Done when:

• [ ] When the app's CSP script-src (or default-src when there is none) names a 'nonce-…', the pill's <script> carries nonce="…" with that value, escaped
• [ ] A nonce is only ever copied from the same response's header, never from the request or the body
• [ ] With no nonce in the policy the tag is as before
• [ ] A test proxies an app answering script-src 'nonce-abc' and proves the tag carries nonce="abc"; a second with a malformed nonce proves nothing is copied; both fail without the change
• [ ] Look: a lab preview shows the pill

Files: src/apps/toolbar.ts, src/apps/proxy.ts, test/apps-toolbar-nonce.test.ts