Add home-page "Still have doubts?" trust band + fix CSP blocking inline styles

Home page: new reassurance band between the live payment feed and the
final CTA — surfaces the three doubts (rules can't change, money never
sits in the contract, keeps running if creators vanish) and routes
skeptics to /contract.

CSP fix (the real find): style-src was 'self' with no 'unsafe-inline',
so the browser was silently dropping EVERY inline style="" attribute
site-wide — the attribute stayed in the DOM but never applied. This is
why the earlier margin fix only worked once moved to a class, and why
the new card rendered left-aligned with a teal eyebrow. Added
'unsafe-inline' to style-src only (script-src stays locked to 'self').
Verified via computed styles + full-page screenshots: home, /contract,
/how-pay-works now render as authored.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

_diag3.mjs

@@ -0,0 +1,15 @@
+import { chromium } from 'playwright';
+const b = await chromium.launch();
+const p = await b.newPage({ viewport: { width: 1200, height: 900 } });
+await p.goto('http://localhost:3107/?t=' + Math.floor(Math.random()*1e9), { waitUntil: 'networkidle' });
+const mine = p.locator('.card', { hasText: 'you should ask hard questions' }).first();
+const r = await mine.evaluate(el => ({
+  inlineTextAlign: el.style.textAlign,
+  inlinePadding: el.style.padding,
+  inlineBorderColor: el.style.borderColor,
+  cssTextLen: el.style.cssText.length,
+  cssText: el.style.cssText,
+  computed: getComputedStyle(el).textAlign,
+}));
+console.log(JSON.stringify(r, null, 2));
+await b.close();