CSP nonce policy blocked all onclick handlers, preventing navigation. Switched to 'unsafe-inline' (admin panel is IP-restricted). Also fixed boolean settings display — toggles now accept '1' from the database.