feat: self-hosted frontend JS (offline) + docker hardening

- Vendored epub.js/pdf.js+worker/JSZip/DOMPurify in static/vendor/
- reader.html/reader.js servono i JS da /static (niente CDN, offline-ready)
- CSP: rimosse allowlist CDN, aggiunto worker-src 'self' blob:
- Test CSP aggiornati; tutti 16 verdi; verificato smoke test offline in container

app.py

@@ -1,4 +1,5 @@
 #!/usr/bin/env python3
+import os
 import socket
 from bookish import create_app
 
@@ -11,7 +12,6 @@ def find_free_port(preferred=5000):
         with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
             if s.connect_ex(("127.0.0.1", port)) != 0:
                 return port
-    # fallback: lascia che il sistema assegni una porta
     with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
         s.bind(("", 0))
         return s.getsockname()[1]
@@ -19,7 +19,11 @@ def find_free_port(preferred=5000):
 
 if __name__ == "__main__":
     import sys
-    preferred = int(sys.argv[1]) if len(sys.argv) > 1 and sys.argv[1].isdigit() else 5000
+    from config import DEBUG
+
+    preferred = int(os.environ.get("PORT", "5000"))
+    if len(sys.argv) > 1 and sys.argv[1].isdigit():
+        preferred = int(sys.argv[1])
     port = find_free_port(preferred)
-    print(f"📚 Bookish avviato su http://0.0.0.0:{port}")
-    app.run(host="0.0.0.0", port=port, debug=True)
+    print(f"Bookish avviato su http://0.0.0.0:{port} (debug={DEBUG})")
+    app.run(host="0.0.0.0", port=port, debug=DEBUG)