feat: self-hosted frontend JS (offline) + docker hardening

- Vendored epub.js/pdf.js+worker/JSZip/DOMPurify in static/vendor/
- reader.html/reader.js servono i JS da /static (niente CDN, offline-ready)
- CSP: rimosse allowlist CDN, aggiunto worker-src 'self' blob:
- Test CSP aggiornati; tutti 16 verdi; verificato smoke test offline in container

.dockerignore

@@ -0,0 +1,17 @@
+.git
+.venv
+.venv.bak
+__pycache__
+*.pyc
+*.pyo
+uploads
+converted
+bookish.db
+docs
+.env
+.sisyphus
+*.md
+!README.md
+.dockerignore
+docker-compose.yml
+.git