feat: self-hosted frontend JS (offline) + docker hardening

- Vendored epub.js/pdf.js+worker/JSZip/DOMPurify in static/vendor/
- reader.html/reader.js servono i JS da /static (niente CDN, offline-ready)
- CSP: rimosse allowlist CDN, aggiunto worker-src 'self' blob:
- Test CSP aggiornati; tutti 16 verdi; verificato smoke test offline in container

requirements.lock

@@ -0,0 +1,112 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pip-compile --no-emit-index-url --no-index --output-file=requirements.lock --strip-extras requirements.in
+#
+beautifulsoup4==4.15.0
+    # via -r requirements.in
+blinker==1.9.0
+    # via
+    #   -r requirements.in
+    #   flask
+brotli==1.2.0
+    # via
+    #   -r requirements.in
+    #   fonttools
+cffi==2.1.0
+    # via
+    #   -r requirements.in
+    #   weasyprint
+click==8.4.2
+    # via
+    #   -r requirements.in
+    #   flask
+cssselect2==0.9.0
+    # via
+    #   -r requirements.in
+    #   weasyprint
+flask==3.1.3
+    # via -r requirements.in
+fonttools==4.63.0
+    # via
+    #   -r requirements.in
+    #   weasyprint
+gunicorn==23.0.0
+    # via -r requirements.in
+itsdangerous==2.2.0
+    # via
+    #   -r requirements.in
+    #   flask
+jinja2==3.1.6
+    # via
+    #   -r requirements.in
+    #   flask
+lxml==6.1.1
+    # via
+    #   -r requirements.in
+    #   python-docx
+markdown==3.10.2
+    # via -r requirements.in
+markupsafe==3.0.3
+    # via
+    #   -r requirements.in
+    #   flask
+    #   jinja2
+    #   werkzeug
+packaging==26.3
+    # via gunicorn
+pillow==12.3.0
+    # via
+    #   -r requirements.in
+    #   weasyprint
+pycparser==3.0
+    # via
+    #   -r requirements.in
+    #   cffi
+pydyf==0.12.1
+    # via
+    #   -r requirements.in
+    #   weasyprint
+pypandoc==1.15
+    # via -r requirements.in
+pyphen==0.17.2
+    # via
+    #   -r requirements.in
+    #   weasyprint
+python-docx==1.2.0
+    # via -r requirements.in
+soupsieve==2.9.1
+    # via
+    #   -r requirements.in
+    #   beautifulsoup4
+tinycss2==1.5.1
+    # via
+    #   -r requirements.in
+    #   cssselect2
+    #   weasyprint
+tinyhtml5==2.1.0
+    # via
+    #   -r requirements.in
+    #   weasyprint
+typing-extensions==4.16.0
+    # via
+    #   -r requirements.in
+    #   beautifulsoup4
+    #   python-docx
+weasyprint==69.0
+    # via -r requirements.in
+webencodings==0.5.1
+    # via
+    #   -r requirements.in
+    #   cssselect2
+    #   tinycss2
+    #   tinyhtml5
+werkzeug==3.1.8
+    # via
+    #   -r requirements.in
+    #   flask
+zopfli==0.4.3
+    # via
+    #   -r requirements.in
+    #   fonttools