fix(voice): allow WASM compilation in CSP for Silero VAD

Add 'wasm-unsafe-eval' to script-src and blob: to worker-src in
Content-Security-Policy header. Required by onnxruntime-web to compile
the Silero VAD ONNX model. Also surface VAD init errors as a toast
instead of silent console log.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/fabledassistant/app.py

@@ -143,10 +143,11 @@ def create_app() -> Quart:
         response.headers.setdefault("Referrer-Policy", "strict-origin-when-cross-origin")
         response.headers.setdefault(
             "Content-Security-Policy",
-            "default-src 'self'; script-src 'self' 'unsafe-inline'; "
+            "default-src 'self'; "
+            "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; "
             "style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; "
             "connect-src 'self'; font-src 'self' data:; object-src 'none'; "
-            "base-uri 'self'; worker-src 'self';"
+            "base-uri 'self'; worker-src 'self' blob:;"
         )
 
         return response