-- Security Headers -->
    <meta http-equiv="Content-Security-Policy" content="default-src 'self'; 
                   connect-src 'self' http://localhost:5179 http://*:5179 http://*:5174; 
                   img-src 'self' http://* https://* data:;
                   script-src 'self' 'unsafe-inline' 'unsafe-eval';
                   style-src 'self' 'unsafe-inline';">
    <meta http-equiv="X-Content-Type-Options" content="nosniff">
    <meta name="referrer" content="strict-origin">
    
    <!-- PWA Supp