Give the dashboard headings their classes, and say what the bare-heading exception covers
server: frontend hygiene — dead JS, fragmented tab JS, inline CSS, img shift
audit Run 15 Phase 5: CSP script-src drops 'unsafe-inline'