feat: improve security headers and csp nonce handling

video.php

@@ -167,7 +167,7 @@ if (empty($videoData) || isset($videoData['error'])) {
     <?php endif; ?>
     
     <!-- Script pour éviter le flash en mode sombre -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         (function() {
             const savedTheme = localStorage.getItem('theme');
             const systemPrefersDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -330,7 +330,7 @@ if (empty($videoData) || isset($videoData['error'])) {
                                     <i class="fas fa-chevron-down" aria-hidden="true"></i>
                                 </button>
                             </div>
-                            <div id="full-description" class="full-description" style="display: none;">
+                            <div id="full-description" class="full-description" style="display: none;" nonce="<?php echo getCspNonce(); ?>">
                                 <?php echo markdown_to_html($video['description']); ?>
                                 <button class="show-less-btn" aria-expanded="true" aria-controls="full-description">
                                     <span>Voir moins</span>
@@ -566,7 +566,7 @@ if (empty($videoData) || isset($videoData['error'])) {
     </div>
     
     <script src="js/main.js"></script>
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         // Script pour la modal de téléchargement
         document.addEventListener('DOMContentLoaded', function() {
             // Gestion de la description tronquée