Server 2.6.1: code field upper-cases and inserts the dash

The phone pages' code field gets one inline script, allowed by its
SHA-256 hash in the CSP; a test checks the served script against the
header. Image pinned by digest in k8s/server.yaml (not applied).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

server/handoff_http.go

@@ -111,7 +111,7 @@ var settingsTemplate = template.Must(template.New("settings").Parse(`<!doctype h
 <form method="post" action="/settings" autocomplete="off">
 {{if .Code}}<div class="code">{{.Code}}</div><input type="hidden" name="code" value="{{.Code}}">
 {{else}}<label for="code">Code shown on the car</label>
-<input id="code" name="code" autocapitalize="characters" placeholder="XXX-XXX" required>{{end}}
+` + codeInput + `{{end}}
 <label for="abrpApiKey">ABRP API key</label>
 <input id="abrpApiKey" name="abrpApiKey" type="password" autocomplete="off" spellcheck="false">
 <label for="abrpToken">ABRP user token</label>
@@ -133,7 +133,7 @@ var settingsTemplate = template.Must(template.New("settings").Parse(`<!doctype h
 func renderSettingsPage(w http.ResponseWriter, status int, data settingsPageData) {
 	h := w.Header()
 	h.Set("Content-Type", "text/html; charset=utf-8")
-	h.Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'")
+	h.Set("Content-Security-Policy", pageCSP)
 	h.Set("X-Content-Type-Options", "nosniff")
 	h.Set("Referrer-Policy", "no-referrer")
 	h.Set("Cache-Control", "no-store")