- Update img-src directive in _headers to include blob: - QR image upload now works in Restore tab - Maintain strict connect-src 'none' security