docs(csp-cors): add a pre-publish checklist for the declared CSP

[shteynu]

Adds a short pre-publish checklist to docs/csp-cors.md for the CSP a server declares in _meta.ui.csp: undeclared origins fail silently in the sandbox, */scheme-only entries open the App to any host, broad subdomain wildcards on shared services, and localhost leaking into published metadata. Also adds one optional verification step to the add-app-to-server skill.

Docs-only, two Markdown files; prettier --check passes locally.

Disclosure: I maintain mcp-app-lint, which the last paragraph mentions. If you'd rather keep the docs tool-neutral, I'll drop that paragraph and the skill step and keep only the checklist.

[shteynu]

Hi, a note for review: this is a docs-only change (two Markdown files). The CI, Publish Any Commit and Docs Preview workflows are waiting for approval because the branch comes from a fork. Locally, prettier --check docs/csp-cors.md passes. If you would rather keep the docs tool-neutral, I'm happy to drop the mcp-app-lint paragraph and the skill step and keep only the checklist; just let me know. Thanks!