refactor: apply thorough CSP

Author: Darcy Ye

static/_headers

@@ -1,5 +1,17 @@
-# Headers for Google Identity Services (One Tap)
-# Only apply COOP headers when Google One Tap is potentially active
-/
+# Headers for Google Identity Services (One Tap) and Content Security Policy
+# This configuration allows Google One Tap to work properly on Cloudflare Pages
+# Based on troubleshooting guide for resolving "Can't continue with google.com" errors
+
+/*
+  # Cross-Origin policies for Google One Tap
   Cross-Origin-Opener-Policy: same-origin-allow-popups
-  Referrer-Policy: no-referrer-when-downgrade
+  Referrer-Policy: strict-origin-when-cross-origin
+  
+  # Content Security Policy for Google One Tap integration
+  # Essential CSP directives to prevent "Can't continue with google.com" errors:
+  # - script-src: Allows Google Identity Services scripts
+  # - img-src: Allows Google profile pictures and branding
+  # - connect-src: Allows network requests to Google's authentication endpoints
+  # - style-src: Allows Google's CSS and inline styles
+  # - font-src: Allows fonts from CDN, Google Fonts, and data URIs
+  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://accounts.google.com https://apis.google.com https://www.gstatic.com https://akasha.logto.io https://cdn.jsdelivr.net; img-src 'self' data: https: https://accounts.google.com https://lh3.googleusercontent.com; connect-src 'self' https://accounts.google.com https://oauth2.googleapis.com https://akasha.logto.io https://cloud.logto.dev https://auth.logto.dev https://cloud.logto.io https://auth.logto.io; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com/css2; font-src 'self' data: https://cdn.jsdelivr.net https://fonts.googleapis.com/css2; object-src 'none'; base-uri 'self'; frame-src 'self' https://cloud.logto.dev https://auth.logto.dev https://cloud.logto.io https://auth.logto.io;