This Site Has No unsafe-inline

A security engineer whose own site needs unsafe-inline has lost the argument before anyone reads a word. So this one does without it, and the constraint shaped real decisions.

Astro inlines small stylesheets by default. That is a sensible performance default and it is incompatible with a strict policy, so build.inlineStylesheets is set to never. Fonts are self-hosted rather than pulled from a font CDN, which keeps font-src at 'self' instead of naming a third-party origin. The one interactive element on the site, the button that copies an email address, lives in an external file rather than an inline handler.

None of that is difficult. It is just a set of choices that has to be made before the code exists, because retrofitting a strict policy onto a site that assumed a loose one means rewriting the parts that assumed it.