fix: CSP blocking hydration and Enable Banking widget, stale auth cleanup

- Add 'unsafe-inline' to script-src so Next.js hydration scripts run
- Whitelist *.enablebanking.com in CSP (script, style, connect, img)
- Allow HTTPS images broadly for third-party bank logos
- Clear stale refresh tokens in middleware (skip on /auth callback)
- Fix login button disabled on browser autofill by reading email from form DOM

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/supabase/middleware.ts

@@ -35,11 +35,19 @@ export async function updateSession(request: NextRequest) {
 
   const {
     data: { user },
+    error: authError,
   } = await supabase.auth.getUser()
 
   // Get the pathname
   const pathname = request.nextUrl.pathname
 
+  // If the refresh token is stale/invalid, clear the session cookies
+  // so the browser stops sending them on every request.
+  // Skip on auth routes — the callback needs PKCE cookies intact.
+  if (authError && !user && !pathname.startsWith('/auth')) {
+    await supabase.auth.signOut()
+  }
+
   // Auth routes - allow access
   if (pathname.startsWith('/login') || pathname.startsWith('/auth')) {
     // If user is logged in and trying to access login, redirect to dashboard or onboarding