Index: src/server.js
===================================================================
--- src/server.js	(revision 7bc636b391c66ac399c33e54f7173a022c6a3cbd)
+++ src/server.js	(revision c88783ea96376fcf4e77aedc4e82bad5d86fbaf0)
@@ -64,5 +64,9 @@
       imgSrc: ["'self'", "data:", "https:"],
       connectSrc: ["'self'", "wss:", "ws:"],
-      mediaSrc: ["'self'", "https:"],
+      // blob: is required for the audio player — it fetch()es track bytes and
+      // plays from a blob: object URL (Spotify-style). Without blob: here the
+      // CSP silently blocks <audio>.src = blob:… → the player fires 'error' and
+      // auto-skips every track. 'self'/https: do NOT imply blob:.
+      mediaSrc: ["'self'", "https:", "blob:"],
       fontSrc: ["'self'"],
       frameSrc: [