fix: resolve CSP and accessibility issues

- Allow inline styles in CSP for Angular component encapsulation
- Hide skip-to-main-content link using screen-reader-only pattern
- Add JavaScript handler for skip link to work across all routes
- Add eslint-disable comments for intentional design choices

api/src/app/plugins/helmet.ts

@@ -13,9 +13,8 @@ const helmetPlugin: FastifyPluginAsync = async (app) => {
     contentSecurityPolicy: {
       directives: {
         defaultSrc: ["'self'"],
-        // Remove unsafe-inline for better security
-        // Angular uses inline styles in development, but production builds should use external CSS
-        styleSrc: ["'self'", process.env.NODE_ENV === "production" ? "'self'" : "'unsafe-inline'"],
+        // Angular uses inline styles for component encapsulation, so we need to allow them
+        styleSrc: ["'self'", "'unsafe-inline'"],
         imgSrc: ["'self'", "data:", "https:"],
         scriptSrc: ["'self'"],
         connectSrc: ["'self'", process.env.FRONTEND_URL ?? "http://localhost:4200"],