updated codemcp.toml with stronger language about alpine.js csp-compliance

codemcp.toml

@@ -9,6 +9,12 @@ project_prompt = '''
 - under no circumstances will there be any need to read or write files outside the code directory
   - do not execute any command that reads, writes, or searches for files outside the code directory
 - at the end of each request, before committing in git, save a copy of the contents of the context window (including the user's original prompt) to a file in the code folder with the filename of "<date>-codemcp-<feature name>.md"
+
+ALPINE.JS CSP COMPLIANCE: All Alpine.js code must be CSP-compliant, meaning:
+- NO JavaScript expressions in HTML attributes (x-show="variable === 0", x-text="method()", etc.)
+- Use x-bind with Alpine.data binding objects instead
+- Pre-compute all display data in Alpine.data properties
+- Never use function calls, method calls, or equality checks in HTML templates
 '''
 
 [commands]