Add home-page "Still have doubts?" trust band + fix CSP blocking inline styles

Home page: new reassurance band between the live payment feed and the
final CTA — surfaces the three doubts (rules can't change, money never
sits in the contract, keeps running if creators vanish) and routes
skeptics to /contract.

CSP fix (the real find): style-src was 'self' with no 'unsafe-inline',
so the browser was silently dropping EVERY inline style="" attribute
site-wide — the attribute stayed in the DOM but never applied. This is
why the earlier margin fix only worked once moved to a class, and why
the new card rendered left-aligned with a teal eyebrow. Added
'unsafe-inline' to style-src only (script-src stays locked to 'self').
Verified via computed styles + full-page screenshots: home, /contract,
/how-pay-works now render as authored.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

_diag3.mjs

@@ -0,0 +1,15 @@
+import { chromium } from 'playwright';
+const b = await chromium.launch();
+const p = await b.newPage({ viewport: { width: 1200, height: 900 } });
+await p.goto('http://localhost:3107/?t=' + Math.floor(Math.random()*1e9), { waitUntil: 'networkidle' });
+const mine = p.locator('.card', { hasText: 'you should ask hard questions' }).first();
+const r = await mine.evaluate(el => ({
+  inlineTextAlign: el.style.textAlign,
+  inlinePadding: el.style.padding,
+  inlineBorderColor: el.style.borderColor,
+  cssTextLen: el.style.cssText.length,
+  cssText: el.style.cssText,
+  computed: getComputedStyle(el).textAlign,
+}));
+console.log(JSON.stringify(r, null, 2));
+await b.close();

public/index.html

@@ -17,6 +17,8 @@
 <section class="section"><div class="wrap"><div class="section-head"><div class="eyebrow">Moving-link workflow</div><h2>Qualify. Then the effort moves down.</h2></div><div class="flow"><div class="flow-step"><b>Step 1</b><strong>Use link</strong><p>Share the current position's referral link.</p></div><div class="flow-step"><b>Step 2</b><strong>Get 2</strong><p>Place exactly two direct positions.</p></div><div class="flow-step"><b>Step 3</b><strong>Retire link</strong><p>Late signups still spill down — bonus depth, not a problem.</p></div><div class="flow-step"><b>Step 4</b><strong>Help your 2</strong><p>Shift the team effort to their links.</p></div><div class="flow-step"><b>Step 5</b><strong>Repeat</strong><p>Keep the qualification wave moving down.</p></div></div></div></section>
 <section class="section"><div class="wrap"><div class="section-head"><div class="eyebrow">Depth over width</div><h2>2 → 4 → 8 → 16 → 32 → 64 → 128 → 256</h2><p>Each generation doubles. A full eight-generation team is <strong>510 positions</strong> (2+4+8+16+32+64+128+256) — but the first milestone that matters is the <strong>30 positions</strong> in your first four generations: 2 + 4 + 8 + 16.</p></div><div class="matrix" aria-label="Matrix growth illustration — eight generations, each double the last"><div class="matrix-group"><div class="people" data-n="2"></div><b>2</b></div><div class="matrix-group"><div class="people" data-n="4"></div><b>4</b></div><div class="matrix-group"><div class="people" data-n="8"></div><b>8</b></div><div class="matrix-group"><div class="people" data-n="16"></div><b>16</b></div><div class="matrix-group"><div class="people" data-n="32"></div><b>32</b></div><div class="matrix-group"><div class="people" data-n="64"></div><b>64</b></div><div class="matrix-group"><div class="people" data-n="128"></div><b>128</b></div><div class="matrix-group"><div class="people" data-n="256"></div><b>256</b></div></div><div class="notice"><strong>Team principle:</strong> once your two are in place, retire your link and shift to helping them get <em>their</em> two — their own directs are the only thing that qualifies their positions to catch payments. And if an extra signup comes through your link anyway, it's a bonus, not a problem: it still pays your position the entry reward and spills downward to fill an open slot in your leg. Spillover never qualifies the people below, though — so the team effort always moves down.</div></div></section>
 <section class="section" id="proof"><div class="wrap"><div class="section-head"><div class="eyebrow">Live payment proof</div><h2>Real payouts, straight from the blockchain.</h2><p>Every payment in this program happens on a public smart contract on Polygon — nobody can fake, hide, or edit it. Below are the latest member payouts, read live from the contract. Tap any row to verify the transaction yourself on Polygonscan.</p></div><div id="payoutTotals" class="pp-totals"></div><div id="payoutFeed" class="pp-feed"><div class="empty">Reading the blockchain…</div></div><div class="pp-note">Data is read directly from the RM Circle smart contract (<a href="https://polygonscan.com/address/0x33BdAEEfd6d17D80aE53816c916dFb26c4fB2DAF" target="_blank" rel="noopener noreferrer" style="color:var(--teal)">0x33Bd…2DAF</a>) on Polygon Mainnet. Member numbers are on-chain IDs, not names. Past payouts are not a promise of future results. <a href="/contract" style="color:var(--gold)">How the contract works — and why the rules can't change →</a></div></div></section>
+<section class="section"><div class="wrap"><div class="card" style="text-align:center;padding:34px;border-color:var(--gold)"><div class="eyebrow" style="color:var(--gold)">Still have doubts?</div><h2 style="font-size:clamp(26px,4vw,34px);margin:10px 0 12px">Good — you <span class="gold">should</span> ask hard questions.</h2><p style="max-width:730px;margin:0 auto 12px;color:var(--muted);line-height:1.7">Before you risk anything, it's smart to ask: <em>Can the rules change after I join? Can anyone take my money? What happens if the people who built this walk away?</em> We read the complete, verified smart-contract code and answered every one of those — in plain language, with links so you can check each claim on the blockchain yourself.</p><p style="max-width:730px;margin:0 auto 22px;color:var(--muted);line-height:1.7">The short version: the code <strong style="color:var(--text)">can't be changed</strong>, member money <strong style="color:var(--text)">never sits in the contract</strong>, and the whole thing <strong style="color:var(--text)">keeps running on its own</strong> — even if its creators disappear.</p><a class="btn btn-primary" href="/contract">See How the Contract Works →</a></div></div></section>
+
 <section class="section"><div class="wrap"><div class="card" style="text-align:center;padding:34px"><div class="eyebrow">Ready to start?</div><h2 style="font-size:38px;margin:10px 0">See the current team placement.</h2><p style="max-width:680px;margin:0 auto 20px;color:var(--muted)">The onboarding page automatically shows the sponsor position the team is currently helping. Always use the sponsor shown there instead of an old screenshot or saved link.</p><a class="btn btn-primary" href="/start">Open Getting Started Instructions →</a></div></div></section>
 </main><footer class="wrap disclaimer">This independent team page is educational and is not an earnings guarantee or investment advice. Cryptocurrency and smart-contract participation involve risk, including possible loss of funds. Never use funds you cannot afford to lose. Results depend on actual participation, qualification, upgrades, smart-contract behavior, and the market value of POL.<div class="footer-links"><a href="/training">Training</a><a href="/start">Getting Started</a><a href="/my">Member Dashboard</a><a href="/contract">Contract Security</a><a href="/admin">Team Admin</a><a href="/disclaimer">Disclaimers</a><a href="/how-pay-works">How You Get Paid</a></div></footer>
 <script src="/track.js"></script><script src="/bridge.js"></script><script src="/payouts.js" defer></script><script src="/chat.js" defer></script></body></html>

server.js

@@ -293,7 +293,7 @@ function publicSponsorPayload(sponsor, config) {
   if(!sponsor)return null;
   return {id:sponsor.id,name:config.showSponsorName?sponsor.name:null,directs:sponsor.directs,goal:2,level:sponsor.level,referralUrl:`${config.dappReferralBaseUrl}${encodeURIComponent(sponsor.id)}`};
 }
-const CSP_BASE="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; connect-src 'self'; font-src 'self' data:; form-action 'self'; frame-src https://www.youtube-nocookie.com";
+const CSP_BASE="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self'; font-src 'self' data:; form-action 'self'; frame-src https://www.youtube-nocookie.com";
 function securityHeaders(extra={}) {
   // Public pages must render inside safelist / traffic-exchange iframes, so framing stays open here; admin.html re-locks it via ADMIN_FRAME_HEADERS.
   return {