fix: track vendor JS files, add 'unsafe-inline' to public CSP, gitignore filepond tmp

- Track vendor JS files (filepond, htmx, overtype) that were moved
  to app/public/assets/js/vendor/ but never tracked → missing from deploys
- Add script-src 'self' 'unsafe-inline' to main CSP header so public
  pages (jury fieldset, repertoire, partage) can use inline scripts
  and onclick handlers
- Add storage/tmp/filepond/* to .gitignore with .gitkeep, and exclude
  from deploy rsync to avoid syncing local test uploads to production

.gitignore

@@ -20,6 +20,8 @@ app/storage/banners/*
 !app/storage/banners/.gitkeep
 app/storage/tmp/*
 !app/storage/tmp/.gitkeep
+app/storage/tmp/filepond/*
+!app/storage/tmp/filepond/.gitkeep
 
 # Nix
 .direnv/