feat: self-hosted frontend JS (offline) + docker hardening

- Vendored epub.js/pdf.js+worker/JSZip/DOMPurify in static/vendor/
- reader.html/reader.js servono i JS da /static (niente CDN, offline-ready)
- CSP: rimosse allowlist CDN, aggiunto worker-src 'self' blob:
- Test CSP aggiornati; tutti 16 verdi; verificato smoke test offline in container

docs/deploy.md

@@ -45,36 +45,20 @@ source .venv/bin/activate
 pip install -r requirements.txt
 ```
 
-### 2. Docker
+### 2. Docker (consigliato in questo fork)
 
-```dockerfile
-FROM python:3.12-slim
-RUN apt-get update && apt-get install -y \
-    libpango-1.0-0 libpangocairo-1.0-0 libgdk-pixbuf2.0-0 \
-    libffi-dev shared-mime-info
-WORKDIR /app
-COPY requirements.txt .
-RUN pip install --no-cache-dir -r requirements.txt
-COPY . .
-RUN mkdir -p uploads converted
-EXPOSE 5000
-CMD ["python", "app.py"]
-```
-
-Build e avvio:
+Usa i file `Dockerfile` e `docker-compose.yml` in root. Non montare un volume su `/app`: cancellerebbe il codice.
 
 ```bash
-docker build -t bookish .
-docker run -d \
-  --name bookish \
-  -p 5000:5000 \
-  -v bookish_data:/app/uploads \
-  -v bookish_data:/app/converted \
-  -v bookish_db:/app \
-  --restart unless-stopped \
-  bookish
+cp .env.example .env
+# imposta BOOKISH_SECRET
+docker compose up --build -d
 ```
 
+Volume unico: `bookish-data` → `/data` (uploads, converted, `bookish.db`).
+
+Gunicorn ascolta su `0.0.0.0:5000` con 1 worker. Healthcheck: `GET /healthz`.
+
 ### 3. Systemd Service
 
 ```ini
@@ -143,9 +127,11 @@ python app.py 8080
 
 | Variabile | Default | Descrizione |
 |---|---|---|
-| `BOOKISH_SECRET` | `bookish-secret-key-change-in-production` | Flask secret key |
-| `BOOKISH_PORT` | 5000 | Porta di partenza per la ricerca |
-| `FLASK_DEBUG` | 0 | Modalità debug (1 per attivare) |
+| `BOOKISH_SECRET` | obbligatorio se debug=false | Flask secret key |
+| `BOOKISH_DATA_DIR` | directory progetto / `/data` in Docker | Upload, convertiti, SQLite |
+| `BOOKISH_DEBUG` | `false` | Modalità debug (`true`/`false`) |
+| `BOOKISH_CLEANUP_HOURS` | `1` | Ore prima di cancellare i file temporanei |
+| `PORT` | 5000 | Porta gunicorn / mapping compose |
 
 ## Manutenzione