[VULN-25] Missing Content-Security-Policy Header

[lyncmi07]

Severity: Critical
Affected area: HTTP response headers (global)

Issue:
No CSP is sent, so XSS impact is maximized and script execution controls are absent.

Mitigation plan:

1. Add baseline CSP for app pages (start report-only, then enforce).
2. Remove inline scripts where possible and adopt nonce/hash strategy if needed.
3. Add policy for frame-ancestors, base-uri, and form-action.

Verification / tests:

• Response-header tests for CSP presence on HTML responses.
• Browser validation for blocked inline execution where policy disallows it.