test: add real CSP violation assertions (#107 remainder)

[Xore]

PR #109 left this explicit gap: "only console-error/external-request checks exist today." Those catch a violation only incidentally, if one happens to also log to console during a normal run -- neither proves the policy is actually enforced nor verifies its exact value.

What

• `trackPageHealth()` now registers a `securitypolicyviolation` listener via `addInitScript` on every page it's attached to, and `assertHealthy()` (now async) fails on any real violation. Every existing call site gets this for free, matching the helper's own stated design goal ("every spec below gets this for free without repeating the wiring").
• New "Testing: WebAuthn/passkey ceremony, select-authenticator, RTL, zoom, forced-colors, and CSP coverage #107 CSP enforcement" describe block:
  • Asserts the login page's actual `Content-Security-Policy` header matches Keycloak's real deployed default (`frame-src 'self'; frame-ancestors 'self'; object-src 'none';` -- confirmed live against the deployed realm's account console, not guessed; this repo's realm fixture carries no `browserSecurityHeaders` override, so Keycloak's own default applies).
  • Drives a real `object-src` violation (same-origin ``, so a failure can only mean object-src, never externalRequests/CORS) to prove enforcement actually fires, not just that the header is present.

    Test plan

    • Both new CSP tests pass against the real disposable-Keycloak harness
    • Full desktop-tier suite run: 2 pre-existing screenshot-diff failures (TOTP QR baseline, 200%-zoom baseline) reproduce identically on the unmodified file too -- confirmed via `git stash` + re-run -- environment font-rendering, not a regression from this change
    • CI