hx-nonce + Alpine CSP build test

1. Alpine reactivity (no unsafe-eval)

Basic Alpine expressions using the CSP build. Should work without unsafe-eval.

2. htmx swap + Alpine reactive content

htmx loads a partial, Alpine reacts to the new content.

3. Alpine state read by htmx hx-vals js:

htmx reads Alpine component state via hx-vals js:. Requires safeEval:true.

4. Alpine CSP limitation — globals not supported

The Alpine CSP build blocks global access entirely — console, window etc. throw "Undefined variable" Alpine errors (check console). Extract logic to Alpine.data() in a nonced <script> tag instead.

5. Alpine CSP self-policed sinks

The Alpine CSP build actively blocks its own dangerous sinks before they reach the DOM — no TT violation needed. These throw Alpine's own errors, not browser TT errors. This means trusted-types htmx alone is sufficient alongside the Alpine CSP build.

x-html — Alpine CSP throws "Using the x-html directive is prohibited"

x-init + insertAdjacentHTML — Alpine CSP throws "Accessing insertAdjacentHTML is prohibited"

x-if / x-for — Alpine CSP handles template cloning internally without hitting TT sinks

x-bind:innerHTML — Alpine CSP blocks this too