feat: self-hosted frontend JS (offline) + docker hardening

- Vendored epub.js/pdf.js+worker/JSZip/DOMPurify in static/vendor/
- reader.html/reader.js servono i JS da /static (niente CDN, offline-ready)
- CSP: rimosse allowlist CDN, aggiunto worker-src 'self' blob:
- Test CSP aggiornati; tutti 16 verdi; verificato smoke test offline in container

docker-compose.yml

@@ -0,0 +1,29 @@
+services:
+  bookish:
+    build: .
+    image: bookish:local
+    ports:
+      - "${PORT:-5000}:5000"
+    environment:
+      BOOKISH_SECRET: ${BOOKISH_SECRET:?Copia .env.example in .env e imposta BOOKISH_SECRET}
+      BOOKISH_DATA_DIR: /data
+      BOOKISH_DEBUG: "false"
+      BOOKISH_CLEANUP_HOURS: ${BOOKISH_CLEANUP_HOURS:-1}
+      # Sicurezza opzionale
+      BOOKISH_AUTH_USERNAME: ${BOOKISH_AUTH_USERNAME:-}
+      BOOKISH_AUTH_PASSWORD: ${BOOKISH_AUTH_PASSWORD:-}
+      BOOKISH_RATE_LIMIT_UPLOAD: ${BOOKISH_RATE_LIMIT_UPLOAD:-20}
+      PORT: "5000"
+    volumes:
+      - bookish-data:/data
+    restart: unless-stopped
+    mem_limit: 1g
+    cpus: "1.0"
+    security_opt:
+      - no-new-privileges:true
+    tmpfs:
+      - /tmp
+    stop_grace_period: 30s
+
+volumes:
+  bookish-data: