[feat] Content Security Policy compatibility

[St4NNi]

Depends on: arunaengine/aruna#363

Goal

The node will serve the portal under a baseline Content-Security-Policy. Make the SPA fully functional under it: no inline script/style violations, all origins declared.

Workplan

1. Run the portal under the baseline policy and fix every violation
2. Add a CI check that boots the portal with CSP enforced

Definition of Done

• All e2e flows green with the baseline CSP enforced