feat: add CSP violation report endpoint with PayloadTooLarge protection

[zeemscript]

This PR implements a CSP (Content Security Policy) violation report endpoint that allows browsers to report policy violations. The endpoint provides structured error handling and deduplication to prevent metric inflation from repeated violations.

• Adds POST /api/v1/csp-report endpoint to receive browser-formatted CSP violation reports
• Implements Redis-based deduplication using hash of (sourceFile, lineNumber, blockedUri)
• Adds Prometheus counter csp_violations_total{directive} for monitoring
• Enforces 8 KiB request body limit with proper 413 PayloadTooLarge response
• Marks endpoint as public (no authentication required) since browsers send reports automatically

Changes

New Files

• src/csp/csp-report.controller.ts - Controller with 8KiB body limit and OpenAPI docs
• src/csp/csp-report.service.ts - Service with Redis-based deduplication logic
• src/csp/csp-report.module.ts - Module registration
• src/csp/dto/csp-report.dto.ts - DTO matching W3C CSP3 report format
• test/csp-report.e2e-spec.ts - E2E tests for all acceptance criteria

Modified Files

• src/app.module.ts - Register CspReportModule
• src/main.ts - Add body-parser config for application/csp-report content type
• src/observability/metrics/metrics.providers.ts - Add csp_violations_total counter
• src/observability/metrics/metrics.service.ts - Add incrementCspViolation() method

Acceptance Criteria

• Handler parses the standard CSP report JSON structure
• Idempotent (re-posting the same report does not double-increment)
• Bound the request size at 8 KiB; larger reports rejected with 413
• OpenAPI decorator documents the endpoint as internal

Test Plan

• Run e2e tests: npm run test:e2e -- --grep "CSP Report"
• Verify endpoint accepts valid CSP reports and returns 204
• Verify duplicate reports are deduplicated (check logs)
• Verify oversized reports (>8KiB) return 413
• Verify Prometheus metrics are incremented at /metrics endpoint
• Verify endpoint is accessible without authentication

Related Issues

Closes #219

[kilodesodiq-arch]

Hi 👋 Appreciate this PR! The CI is flagging a failing check — could you take a peek at the failed job and push a fix? Happy to help if you need a hand 🙏