be8801aef7
External image requests to openweathermap.org fail silently in Chrome Android PWA standalone mode. Icons are now proxied via GET /api/v1/weather/icon/:code, making them same-origin — cacheable by the service worker and free of CORS/CSP issues. Tightened CSP: removed openweathermap.org from imgSrc (no longer needed). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>