threejs-server example cannot work within current spec due to `unsafe-eval`

Describe the bug

The three.js app uses this code:

https://github.com/modelcontextprotocol/ext-apps/blob/e514e6c745554f2aa18250116d0ada4c6bf0ffb2/examples/threejs-server/src/threejs-app.tsx#L122-L137

This requires the unsafe-eval CSP policy. However, the server does not define a CSP policy and from my understanding of the spec it should not be provided by default

https://github.com/modelcontextprotocol/ext-apps/blob/e514e6c745554f2aa18250116d0ada4c6bf0ffb2/specification/draft/apps.mdx?plain=1#L202-L211

Additionally, there is no way to make it work as the spec currently does not provide servers a way to request unsafe-eval:

https://github.com/modelcontextprotocol/ext-apps/blob/e514e6c745554f2aa18250116d0ada4c6bf0ffb2/specification/draft/apps.mdx?plain=1#L1411-L1426

To Reproduce
Steps to reproduce the behavior:

1. Build a complient client with CSP policies
2. Try to run the threejs example

You get an error:

Expected behavior

I think the spec should be revised to support trusted types or let the UI request unsafe-eval

Logs
N/A

Additional context
N/A

Start by reproducing the threejs-server example with a CSP-enforcing client, then read the referenced code in examples/threejs-server/src/threejs-app.tsx and the CSP sections of specification/draft/apps.mdx. Determine whether the specification or example must change; done means the spec and example provide an agreed, runnable path without the current unsafe-eval failure.