csp-options

[itsharrykim]

Summary

• Add environment-driven CSP settings for default-src, script-src, style-src, img-src, font-src, connect-src, and frame-ancestors
• Support path-based same-origin framing for selected routes, including matching X-Frame-Options behavior
• Document the new environment variables in .env.example
• Add middleware tests covering defaults, overrides, and same-origin embed paths

Testing

• Added unit tests for default security headers, config overrides, and embed route behavior
• Not run (not requested)