docs: close the CSP and font-ETag check against the test server

Deployed at 1.1.0-post.669f928: the policy is untouched and still admits the
fonts, each comes back as font/woff2 with a content ETag that answers a
matching If-None-Match with 304, and the signed-out page renders in Plex over
the network. The remaining open items all need a signed-in session with real
mail behind it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/plans/visual-style.md

@@ -191,10 +191,13 @@ Nothing here blocks the item; each is written down so it is not rediscovered.
    All three need a running Postfix, so they are a test-server check, not a
    local one. `table.log` is the only restyled component with no screenshot
    behind it.
-4. **CSP and the font ETags were verified locally from saved files**, where no
+4. ~~**CSP and the font ETags**~~ — **done** on the test server at
-   policy header is served at all. That the panel's own `default-src 'self'`
+   `1.1.0-post.669f928`. The policy is unchanged
-   admits the WOFF2 files, and that they come back with a validator, is a
+   (`default-src 'self'; object-src 'none'; base-uri 'none'; form-action 'self';
-   test-server check.
+   frame-ancestors 'none'`) and admits all three fonts, which come back as
+   `font/woff2` with `Cache-Control: no-cache` and a content ETag: a matching
+   `If-None-Match` gets 304, a stale one gets the bytes. The signed-out page
+   renders in Plex over the network.
 5. **`font-display: swap` has never been observed** — every render had the fonts
    already on disk. Worth one cold load over the network to see how long the
    system stack is on screen.