<!DOCTYPE html>
<html lang="en" dir="ltr">
<head>
  <meta charset="UTF-8" />
  <meta name="viewport" content="width=device-width, initial-scale=1.0" />

  <!-- Internal tool: never index, never follow, never cache a preview -->
  <meta name="robots" content="noindex, nofollow, noarchive, nosnippet, noimageindex" />
  <meta name="googlebot" content="noindex, nofollow" />
  <meta name="referrer" content="same-origin" />

  <!-- frame-ancestors is delivered as a header in vercel.json; it is ignored in <meta>.
       No analytics, no fonts CDN, no third parties. The admin panel talks to
       exactly one origin: the Supabase project that serves its API. -->
  <meta http-equiv="Content-Security-Policy" content="
    default-src 'self';
    script-src 'self';
    style-src 'self' 'unsafe-inline';
    img-src 'self' data: https:;
    font-src 'self' data:;
    connect-src 'self' https://skehqotxrtooizkzemxq.supabase.co;
    base-uri 'self';
    form-action 'self';
  " />

  <title>HUX Admin</title>
  <link rel="icon" href="data:," />
  <script type="module" crossorigin src="/assets/admin-DyjBVGs7.js"></script>
  <link rel="stylesheet" crossorigin href="/assets/admin-Be2m1DC7.css">
</head>
<body>
  <div id="root"></div>
</body>
</html>
