feat: self-hosted frontend JS (offline) + docker hardening

- Vendored epub.js/pdf.js+worker/JSZip/DOMPurify in static/vendor/
- reader.html/reader.js servono i JS da /static (niente CDN, offline-ready)
- CSP: rimosse allowlist CDN, aggiunto worker-src 'self' blob:
- Test CSP aggiornati; tutti 16 verdi; verificato smoke test offline in container

run.sh

@@ -1,5 +1,19 @@
 #!/bin/bash
-# Avvia Bookish con virtualenv
 DIR="$(cd "$(dirname "$0")" && pwd)"
 cd "$DIR" || exit 1
-.venv/bin/python app.py "${1:-5000}"
+
+if [ ! -x .venv/bin/python ]; then
+  echo "Crea il venv: python3 -m venv .venv && .venv/bin/pip install -r requirements.txt"
+  echo "Serve anche pandoc: sudo apt install pandoc"
+  echo "Oppure: cp .env.example .env && docker compose up --build"
+  exit 1
+fi
+
+if ! command -v pandoc >/dev/null 2>&1; then
+  echo "pandoc non trovato. Installa: sudo apt install pandoc"
+  echo "Oppure usa Docker: docker compose up --build"
+  exit 1
+fi
+
+export BOOKISH_DEBUG="${BOOKISH_DEBUG:-true}"
+exec .venv/bin/python app.py "${1:-5000}"