fix: handle Node.js 25+ where window is defined in SSR context

[CodeLine9]

Bug

Node.js 25 ships an experimental Web Storage API where window is aliased to globalThis. This means typeof window === 'undefined' returns false on the server, breaking the SSR guard in isServer. The library then tries to call localStorage.getItem() in a server context where it's not fully implemented, causing TypeError: localStorage.getItem is not a function.

Fix

Add typeof document === 'undefined' to the isServer check. document is only available in browser environments, not in Node.js even when window is polyfilled. Also use isServer consistently for the nonce attribute instead of re-checking typeof window.

Closes #389

[CodeLine9]

Closing — no longer pursuing contributions here.