acf8f9f4da
The Content-Security-Policy header (default-src 'self') blocked inline onclick attributes, silently preventing the Edit and Delete buttons in the user management modal from firing. Replaced with data-id attributes and a delegated click listener on the users-list container.