{# PostHog and Clarity keys — read by cookie-banner.js after consent is given. No inline scripts; keys passed via data attributes to avoid CSP hash issues. #}