feat(security): enforce the Content Security Policy

The report-only run showed no violation in production.

README.md

@@ -47,7 +47,7 @@ To Be Played is split into three repositories:
 - react-hook-form + zod for forms, i18next for translations (`public/i18n`)
 - Vitest + React Testing Library + jsdom
 - Production image: nginx (Alpine), SPA fallback, long-term caching for hashed assets, Content Security Policy
-  (report-only for now) and security headers
+  and security headers
 - CI: Forgejo Actions (`npm ci`, `npm test`, `npm run build`, Docker image)
 
 ## Project structure
@@ -91,7 +91,6 @@ npm run build
 ## Roadmap
 
 - Mood filter for "What to play next".
-- Enforce the Content Security Policy (it runs in report-only mode now).
 
 ## License