Configure CSP via Next.js middleware (not `vercel.json`) and include the correct nonce-based `script-src` (letting Next.js automatically inject nonces into `_next` script tags). Ensure the root `app/layout.tsx` is set to `dynamic` so a fresh nonce is produced on each request.

1d7793b9-c160-4983-80f2-466f645d6582