[FEATURE] Add CSP headers to frontend

**Category:** security / frontend
**Project area:** frontend/, deployment/

**Implementation:**
- Strict Content-Security-Policy via meta tag or server header.
- Nonce-based inline script allowlist.
- Report violations to /api/csp-report.

**Acceptance Criteria:**
- CSP blocks unauthorized inline scripts.
- Violation reports logged.
- No legitimate functionality broken.