fix: allow same-origin PWA manifests in CSP

[Chris0Jeky]

Refs #2045

Summary

• Add manifest-src 'self' to the API's production CSP default so the same-origin web manifest is permitted.
• Add API regression coverage requiring the exact same-origin directive while preserving default-src 'none'.

Verification

• SecurityHeadersApiTests: 7/7
• Mutation check: removing only manifest-src 'self' made the new test fail because no manifest directive was emitted; configuration was restored and the class returned to 7/7.
• git diff --check: passed
• Packaged-browser proof, reverse-proxy parity, and documentation updates: NOT included in this bounded slice.

Two coordinator review passes completed for security semantics and integration/scope.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.