Send a CSP and security headers from the frontend's nginx

script-src admits the bundle and the pre-paint theme script by hash, with no
unsafe-inline or unsafe-eval; style-src keeps unsafe-inline for the <style>
elements Monaco, Radix and the toasts insert. frame-ancestors 'self',
nosniff and strict-origin-when-cross-origin go with it, and the Dockerfile
adds the API origin to connect-src when the bundle calls one elsewhere. Zod
runs jitless so its eval probe is not reported on every page. The embed
widget keeps allow-same-origin: the demo's weather map does not render
without it; the comment now says so and what it costs.

frontend/src/components/Dashboard/widgets.tsx

@@ -474,8 +474,12 @@ function EmbedWidget({ widget }: WidgetProps) {
     <iframe
       src={url}
       title={widget.title || url}
-      // Same-origin is deliberately withheld: the page keeps its own storage
-      // and cookies only by being another origin, which it is.
+      // `allow-same-origin` keeps the page in its own origin, with the
+      // cookies and storage most sites will not start without: the demo's
+      // weather map renders an unstyled list without it. That is safe only
+      // while the page *is* another origin. One served from this app's own
+      // origin would run as the app, scripts and all, and could read the
+      // session.
       sandbox="allow-scripts allow-popups allow-forms allow-same-origin"
       referrerPolicy="no-referrer"
       loading="lazy"