fix(security): add SPA CSP, drop x-powered-by, strengthen dedupe hash

Address SonarQube security hotspots on the website:

- server/src/app.js: replace `contentSecurityPolicy: false` with a helmet CSP
  tuned for the built React SPA (script-src 'self'; style-src adds 'unsafe-inline'
  for React inline styles + the Google Fonts stylesheet; font-src gstatic; img-src
  allows data:/https: for uploads, embedded body images and BRAND_* assets;
  connect-src 'self' for REST+SSE). upgrade-insecure-requests is intentionally
  omitted (TLS terminates at the proxy; keeps local `npm start` over http working).
  The /api/docs Swagger UI route gets a scoped looser policy (inline script/style)
  since swagger-ui-express injects an inline bootstrap.
- client/vite.config.js: disable the inline module-preload polyfill so code-split
  builds keep `script-src 'self'` valid (RichTextEditor is a separate chunk).
- bot/src/app.js, server/src/internalApp.js: disable x-powered-by on the two
  internal-only listeners (the public app already strips it via helmet).
- shardEvents dedupe key: SHA-1 -> SHA-256 truncated to 40 hex chars (fits the
  existing CHAR(40) column, no migration; it is a content fingerprint, not a
  security value). schema.sql comment updated to match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NgyHnrNa8WwG3doxvxjuCr

server/db/schema.sql

@@ -333,8 +333,9 @@ CREATE TABLE IF NOT EXISTS uo_link_config (
 -- IDOC transitions, quests, skill.gain, fame/karma, audit.*, cheat.*, link.*,
 -- server.*). High-frequency kinds (char.vitals, economy.supply) are NOT logged
 -- here — they update shard_online / shard_economy instead, keeping the log lean.
--- dedupe_key = sha1(kind + t + stable-json(payload)); with the UNIQUE index it
--- makes INSERT IGNORE idempotent so WS-reconnect backfill never double-inserts.
+-- dedupe_key = sha256(kind + t + stable-json(payload)) truncated to 40 hex chars
+-- (fits CHAR(40)); with the UNIQUE index it makes INSERT IGNORE idempotent so
+-- WS-reconnect backfill never double-inserts.
 CREATE TABLE IF NOT EXISTS shard_events (
   id          BIGINT AUTO_INCREMENT PRIMARY KEY,
   kind        VARCHAR(48)  NOT NULL,