fix(status-page): inject sanitized customCSS on the public page

The customCSS field on status pages was persisted and validated
end-to-end but never rendered on the public page, so operator-supplied
styles had no effect.

Inject the string as a <style> tag on the public route (which the
admin preview iframe also renders), reusing the existing
cssReferencesExternalResource check so external-resource CSS
(@import, url(http…), //…) is dropped defensively on the client.

The admin preview iframe already points at the public URL, so this
one insertion covers both the live page and the in-app preview.

client/src/Pages/StatusPage/Status/index.tsx

@@ -21,6 +21,7 @@ import {
 	getStatusPagePublicUrl,
 	isCustomDomainHost,
 } from "@/Utils/statusPageUrl";
+import { cssReferencesExternalResource } from "@/Utils/customCss";
 import { HeaderStatusPageControls } from "@/Pages/StatusPage/Status/Components/HeaderStatusPageControls";
 import { StatusPageThemeProvider } from "@/Pages/StatusPage/Status/themes/StatusPageThemeProvider";
 import {
@@ -132,6 +133,10 @@ const StatusPageView = () => {
 	// Public route: render directly on the viewport, themed background covers everything.
 	if (isPublic) {
 		const themeConfig = THEME_CONFIGS[resolveStatusPageTheme(statusPage.theme)];
+		const customCss =
+			statusPage.customCSS && !cssReferencesExternalResource(statusPage.customCSS)
+				? statusPage.customCSS
+				: "";
 		return (
 			<StatusPageThemeProvider
 				theme={statusPage.theme}
@@ -139,6 +144,7 @@ const StatusPageView = () => {
 				timezone={statusPage.timezone}
 				paintBody
 			>
+				{customCss && <style>{customCss}</style>}
 				<BaseStatusPage
 					statusPage={statusPage}
 					monitors={monitors}