The public landing page's CSP allows Cloudflare Web Analytics (browser check, WS-Q task 3): script-src https://static.cloudflareinsights.com loads the beacon Cloudflare injects at the edge, connect-src https://cloudflareinsights.com is where it reports; the page still runs no script of its own. The network's privacy text already says Cloudflare may measure performance; default-src 'none' blocked it and logged a CSP error. Test: public-host.test.js

ddiff --git a/server/app.js b/server/app.js
iindex 32ce11b..4240f98 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -102,7 +102,10 @@ function createApp({ config, db, registry, items, ingest, scheduler, auth, keys,
          res.setHeader('X-Robots-Tag', 'noindex, nofollow');
          res.setHeader('Vary', 'Accept');
          if (/\btext\/html\b/.test(String(req.get('accept') || ''))) {
--            res.setHeader('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; frame-ancestors 'none'");
++            // The page runs no script of its own. Cloudflare Web Analytics: Cloudflare injects its beacon at the
++            // edge and the privacy text says it may measure performance; script-src loads it, connect-src is
++            // where it reports.
++            res.setHeader('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; script-src https://static.cloudflareinsights.com; connect-src https://cloudflareinsights.com; base-uri 'none'; frame-ancestors 'none'");
              return res.type('html').send(HOME_HTML);
          }
          return res.type('text/plain').send(TEXT_INDEX);
ddiff --git a/test/public-host.test.js b/test/public-host.test.js
iindex feb3b55..e3bc407 100644
---- a/test/public-host.test.js
++++ b/test/public-host.test.js
@@@ -25,6 +25,8 @@ t('browsers get a short honest HTML page: internal service, nothing to browse, n
      assert.strictEqual(r.headers.get('x-robots-tag'), 'noindex, nofollow');
      assert.strictEqual(r.headers.get('cache-control'), 'no-store');
      assert.match(r.headers.get('content-security-policy'), /default-src 'none'/);
++    // No script of its own; only Cloudflare Web Analytics, which Cloudflare injects at the edge, may load and report.
++    assert.match(r.headers.get('content-security-policy'), /script-src https:\/\/static\.cloudflareinsights\.com; connect-src https:\/\/cloudflareinsights\.com;/);
      assert.ok(!/<script/i.test(r.text));
      assert.ok(!/admin/i.test(r.text));
  });