Server 2.6.1: code field upper-cases and inserts the dash

The phone pages' code field gets one inline script, allowed by its
SHA-256 hash in the CSP; a test checks the served script against the
header. Image pinned by digest in k8s/server.yaml (not applied).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

SPECS.md

@@ -118,6 +118,12 @@ tyre pressures, GPS (lat, lon, elevation, heading) and the is_* flags. It does *
   confirmed car facts, app structure, UI conventions, build/test/ship, documents. It replaces
   upstream's EVABRPUploader text. The test emulator is now in the flake: `nix run .#car-emulator`
   (Android 9 AOSP at 1920×720, 160 dpi; the car build installs as the system user — checked).
+- 2026-10-19 — Server 2.6.1: the code field on the phone pages (`/pair`, `/settings`, when opened
+  without the code in the link) upper-cases what is typed and puts the dash in after the third
+  character. That takes the pages' first script: one inline script, allowed by its SHA-256 hash in
+  the CSP (`script-src 'sha256-…'`, still `default-src 'none'`); a test checks the served script
+  against the header. Without it the server still accepts the code in any case, with or without
+  the dash. Image pinned by digest in `k8s/server.yaml` (not applied).
 - 2026-10-18 — README brought up to date: screenshots of all seven tabs from 2.18.1 at the car's
   1778×640 window (the upstream and 2.8.2 screenshots are gone), tab descriptions, updating over
   the air and from a USB stick, the emulator, the release relay. OTA.md: updates are checked from