Desktop webview has CSP off while global Tauri IPC is exposed #171

Noticed the desktop Tauri config currently has both:

"withGlobalTauri": true

and:

"csp": null

If any markup injection lands in the webview, there’s not much backup protection before script can reach the global Tauri API.

Eeespecially risky with stored or reflected frontend bugs, since the app has Tauri commands for setup/runtime/download/save flows.

Would it make sense to either:

• disable withGlobalTauri and use scoped imports instead
• add a stricter CSP for the desktop webview

Flagging separately from the folder-name XSS since even after that specific bug is fixed, this still seems like a useful hardening step.