[codex] Add board page CSP header

[lovasoa]

Summary

Add Content-Security-Policy to templated board HTML responses and centralize the policy string so board HTML, static assets, and SVG responses use the same header source.

Root Cause

CSP was defined in server/server.mjs, but board HTML responses are built through server/templating.mjs:startHtmlResponse. That path set Content-Type, Cache-Control, ETag, and Vary, but never attached Content-Security-Policy, so /boards/<name> shipped without CSP while static and SVG routes still had it.

What Changed

• added server/security_headers.mjs as the shared CSP source
• switched server/server.mjs static, SVG, and preview responses to use the shared CSP constant
• added CSP to templated HTML responses in server/templating.mjs
• added a route test asserting the board page returns the CSP header

Impact

Board HTML responses now send CSP instead of only static assets and SVG endpoints doing so.

Validation

• node --test test-node/server_routes.test.js
• node --test test-node/server_routes.test.js test-node/turnstile.test.js
• npm test ❌
  • node --test test-node/*.test.js passed
  • playwright test failed in 9 specs, so lint did not run

Remaining Work

The current CSP is still too strict for the browser runtime.

Evidence:

• Turnstile needed explicit script-src and frame-src allowances for https://challenges.cloudflare.com
• after that adjustment, Playwright still failed broadly across auth, collaboration, reconnect, and Turnstile flows
• the failure pattern suggests additional board-page runtime requirements are blocked, likely inline boot scripts and/or other browser-side policy needs

Follow-up needed:

• inspect the failing Playwright cases against browser CSP violations
• identify the minimum additional CSP allowances needed for the board page to boot correctly
• rerun the full npm test gate after narrowing the policy