Apply CSP to generated status responses

[tomcatzh]

What changed

• attach the validated content_security_policy value to 404, 405, 406, and internal status responses generated by EmbeddedSpa
• preserve the existing None opt-out for both entry and status responses
• add HTTP-contract coverage for the default and disabled configurations
• document the crate boundary: application routes and redirects still need middleware or reverse-proxy headers

Why

EmbeddedSpaConfig already validates and stores one CSP policy, but the implementation only added it to the HTML entry point. A missing immutable asset therefore returned a crate-owned 404 without the configured policy, creating inconsistent response coverage.

Impact

Successful entry, SPA fallback, static asset, ETag, compression, cache, and body behavior are unchanged. The only observable behavior change is that crate-generated empty status responses now carry the configured CSP. Application-generated redirects and API responses remain outside this crate.

Validation

• make check — 9 unit tests, 12 HTTP contract tests, Clippy with -D warnings, rustdoc
• make test-nginx — Nginx 1.29.8-alpine, 8 MIME types, identity/gzip/Brotli, MISS/HIT/REVALIDATED, fresh-cache 304
• cargo package --allow-dirty — 45 packaged files and verified package build

[tomcatzh]

Review: LGTM ✅

Reviewed locally on top of current main (62283a3). The change attaches the already-validated content_security_policy to crate-generated empty status responses, closing the gap where a missing immutable asset returned a crate-owned 404 without the configured CSP. The None opt-out is preserved, both configurations have contract-test coverage, and docs/CHANGELOG state the crate boundary accurately.

Verified: cargo test --all-targets (9 unit + 10 contract tests pass), cargo clippy --all-targets -- -D warnings clean, cargo fmt --check clean.

(Note: GitHub does not allow approving your own PR from the same account, so recording the review result here.)