feat: self-hosted frontend JS (offline) + docker hardening

- Vendored epub.js/pdf.js+worker/JSZip/DOMPurify in static/vendor/
- reader.html/reader.js servono i JS da /static (niente CDN, offline-ready)
- CSP: rimosse allowlist CDN, aggiunto worker-src 'self' blob:
- Test CSP aggiornati; tutti 16 verdi; verificato smoke test offline in container

requirements.txt

@@ -14,7 +14,8 @@ MarkupSafe==3.0.3
 pillow==12.3.0
 pycparser==3.0
 pydyf==0.12.1
-pypandoc_binary==1.17
+pypandoc==1.15
+gunicorn==23.0.0
 pyphen==0.17.2
 python-docx==1.2.0
 soupsieve==2.9.1