PolHunter embed on /training, CSP allows polhunter.com

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

public/training.html

@@ -106,4 +106,5 @@
 </div></section>
 </main>
 <footer class="wrap disclaimer">This is an independent RM Circle Team Build training resource. Always confirm transaction details in your wallet before signing. Never disclose your Secret Recovery Phrase.<div class="footer-links"><a href="/">Strategy</a><a href="/start">Getting Started</a><a href="/contract">Contract Security</a><a href="/admin">Team Admin</a><a href="/disclaimer">Disclaimers</a><a href="/how-pay-works">How You Get Paid</a><a href="/tools">Promo Tools</a><a href="/privacy">Privacy</a><a href="/refunds">Refunds</a></div></footer>
-<script src="/track.js"></script><script src="/rmc-wallet.js"></script><script src="/inapp-browser.js"></script><script src="/training.js"></script><script src="/wallet-notice.js" defer></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/vtt-lang.js" defer></script><script src="/tg-app.js" defer></script><script src="/nav-dash.js" defer></script></body></html>
+<script src="/track.js"></script><script src="/rmc-wallet.js"></script><script src="/inapp-browser.js"></script><script src="/training.js"></script><script src="/wallet-notice.js" defer></script><script src="/chat.js" defer></script><script src="/translate.js" defer></script><script src="/vtt-lang.js" defer></script><script src="/tg-app.js" defer></script><script src="/nav-dash.js" defer></script><script src="https://polhunter.com/embed.js" data-selector=".video-card" data-slots="10" async></script>
+</body></html>

server.js

@@ -578,7 +578,7 @@ async function handleTranslate(req,res){
 
 // frame-src includes 'self' so our own pages (the Page Builder preview framing
 // a member's /p/<id> page) are not blocked by our own policy.
-const CSP_BASE="default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; media-src 'self' https://coolify-saasytop.nyc3.digitaloceanspaces.com; connect-src 'self'; font-src 'self' data:; form-action 'self'; frame-src 'self' https://www.youtube-nocookie.com";
+const CSP_BASE="default-src 'self'; script-src 'self' https://polhunter.com; style-src 'self' 'unsafe-inline'; img-src 'self' data:; media-src 'self' https://coolify-saasytop.nyc3.digitaloceanspaces.com; connect-src 'self' https://polhunter.com; font-src 'self' data:; form-action 'self'; frame-src 'self' https://www.youtube-nocookie.com"; // polhunter.com: the PolHunter embed on /training (2026-09-19)
 function securityHeaders(extra={}) {
   // Public pages must render inside safelist / traffic-exchange iframes, so framing stays open here; admin.html re-locks it via ADMIN_FRAME_HEADERS.
   return {