feat: add IFRAME_CSP env var for srcdoc iframe content security policy

Adds an IFRAME_CSP environment variable that injects a Content-Security-Policy
<meta> tag into all srcdoc iframes rendering untrusted content:
- Artifacts (LLM-generated HTML previews)
- FullHeightIframe (tool/embed output)
- FilePreview (user-uploaded HTML files)
- CitationModal (RAG document HTML)

Shared utility in src/lib/utils/csp.ts handles injection with HTML-safe
attribute escaping. URL-based iframes (src=) are correctly excluded.

Env-var only — no PersistentConfig, no admin UI, no DB. Set once at deploy
time, requires restart. Empty string (default) means no CSP restriction.

src/lib/utils/csp.ts

@@ -0,0 +1,14 @@
+/**
+ * Prepend a Content-Security-Policy <meta> tag to HTML.
+ * First CSP meta tag wins per spec, so any existing CSP
+ * in the HTML is effectively overridden.
+ */
+export function injectCsp(html: string, csp: string): string {
+	if (!csp) return html;
+	const escaped = csp.replace(/"/g, '&quot;');
+	const tag = `<meta http-equiv="Content-Security-Policy" content="${escaped}">`;
+	const idx = html.indexOf('<head>');
+	return idx !== -1
+		? html.slice(0, idx + 6) + tag + html.slice(idx + 6)
+		: tag + html;
+}