SW-registration inline script blocked by CSP (missing nonce) — PWA offline/install/caching dead in prod

coder-venus diagnosed (Elazar-routed): src/app/layout.tsx:105-109 hand-written <script dangerouslySetInnerHTML> for service-worker registration has NO nonce. CSP (src/proxy.ts) = nonce + strict-dynamic, drops unsafe-inline, so this inline script is blocked every request → SW never registers → PWA offline/install/caching silently dead. Next auto-nonces framework + next/script <Script> but NOT a raw <script> tag. PROOF ours not extension: sha256 of our script == browser-suggested hash v33UsaSCGdhrkZ6cEMRff7bGsqMOwEy3kEtTO0MEuM0=; only authored inline script (grep-confirmed). NOT a security hole (CSP working as designed). FIX (1 file ~4 lines): read per-request nonce from CSP header via next/headers in layout.tsx, set nonce={nonce} on the script — nonce PASSTHROUGH, does NOT weaken CSP (no unsafe-inline, script-src unchanged). Reject the hash-pin alternative (fragile). Security-header surface -> pre-push audit-venus diff review + PTD.