Allow the same-origin PWA manifest under the production CSP

[Chris0Jeky]

Context

Exact-main packaged Windows proof after #2039/#2041 found the font/style CSP repair green but exposed a separate PWA manifest directive gap.

The API emits default-src 'none' without manifest-src. Chrome therefore blocks the same-origin /manifest.webmanifest request by falling back to default-src, and reports a CSP console issue on the packaged desktop surface. This is independent of the repaired font path: all 12 bundled WOFF2 resources loaded from same-origin with zero font/style CSP violations.

Evidence boundary:

• exact head: 3fa6071763404255d2bc25b5f2b936647139c35b
• no-publish Windows rehearsal: https://github.com/Chris0Jeky/Taskdeck/actions/runs/32692308935
• untouched product ZIP SHA-256: 9981177c734300d1f97fd51f3a1b77a882d57ea5d640276c2c7e1339c9d3cbd5
• isolated synthetic %LOCALAPPDATA%, unrelated launch cwd, fresh synthetic account
• Chrome console: manifest load refused because manifest-src is absent and default-src 'none' applies

Acceptance criteria

• Permit only same-origin web manifests with manifest-src 'self' in the API's production CSP default.
• Pin the directive in security-header regression coverage and the configuration reference.
• Reconcile any reverse-proxy CSP example/default that serves the same frontend contract.
• Rerun an untouched packaged browser proof and show /manifest.webmanifest is not blocked by CSP.
• Preserve default-src 'none', same-origin font/style/script constraints, and Swagger's existing exclusion boundary.
• Reconcile the PWA installability claim in docs/platform/PWA_OFFLINE_BEHAVIOR.md with the verified deployment surfaces.

Scope

CSP/PWA contract only. No service-worker strategy, offline write queue, native-app, or release-tag expansion.