v1.2.0

Changed - Architecture

• File split: index.html refactored into three separate files - index.html (markup only), style.css (all CSS), app.js (all JavaScript + Turnstile loader)
• No inline event handlers: all onclick, ondragover, ondragleave, ondrop HTML attributes removed; replaced with addEventListener calls in app.js
• No inline styles: all style="..." HTML attributes moved to CSS classes and ID rules in style.css (#turnstileContainer, #turnstileFallback, #customRange, .preview-scroll, .security-verification-text, .contact-byline, .header-brand img, etc.)
• Turnstile loader: moved from an inline <script> in <head> to the top of app.js; app.js loaded with defer - DOM is guaranteed ready when it executes

Changed - Security

• CSP 'unsafe-inline' fully eliminated: removed from both script-src and style-src in _headers
  • Before: script-src 'self' 'unsafe-inline' ..., style-src 'self' 'unsafe-inline'
  • After: script-src 'self' https://cdnjs.cloudflare.com https://challenges.cloudflare.com, style-src 'self'
  • Inline script and style injection are now blocked at the CSP level with no exceptions

Added

• id="helpBtn", id="uploadBtn", id="popupClose", id="turnstileReloadBtn" - added to elements that previously used onclick attributes, required for addEventListener binding
• CSS classes: .turnstile-error-title, .turnstile-error-desc, .turnstile-reload-btn, .security-verification-text, .preview-scroll, .contact-byline - replace former inline style="..." attributes

---