[feat] Content Security Policy compatibility

[St4NNi]

Depends on: arunaengine/aruna#363

Goal

The node will serve the portal under a baseline Content-Security-Policy. Make the SPA fully functional under it: no inline script/style violations, all origins declared.

Workplan

1. Run the portal under the baseline policy and fix every violation
2. Add a CI check that boots the portal with CSP enforced

Definition of Done

• All e2e flows green with the baseline CSP enforced

[St4NNi]

Status: partial on feat/portal-next (pending): editors mount in shadow roots with constructed stylesheets to satisfy style-src 'self', PDF preview uses blob: frames, and the module entry has no inline scripts. Still open: a CI check booting the portal with the baseline CSP enforced (index.html also still loads Google Fonts cross-origin, which the served policy must allow).