server: mailmap, commit trailers, and annotated tag bodies
server: add a Notes tab to the git browser
audit Run 15 Phase 5: CSP script-src drops 'unsafe-inline'