CSP violation reports: ingest endpoint, ClickHouse storage, UI view

- POST /v1/csp collects browser CSP reports in both wire formats (legacy
  application/csp-report and Reporting API application/reports+json), with
  CORS limited to the operator's domains (any subdomain of k6n.net,
  tornberg.me, knatofs.se) and preflight handling.
- Reports are stored in a dedicated typed ClickHouse table (csp_reports,
  90-day TTL) with a JSONL file fallback (OTEL_CSP_PATH).
- New authenticated view endpoints /api/csp/reports and /api/csp/summary
  plus a 'CSP reports' screen in the UI (tab 12) with time window, site and
  directive filters and report drill-down.
- Documented in instrumentation.md; unit tests for parsing/handlers/file
  store and an env-gated ClickHouse integration test.

instrumentation.md

@@ -117,6 +117,29 @@ options (on the RUM or todo script, or `OtelRUM.init({ todo: {...} })`): `data-s
 Todos go to ClickHouse when configured, else to the JSONL file at `OTEL_TODOS_PATH`
 (default `otel-todos.jsonl`).
 
+## CSP violation reports
+
+Browsers report Content-Security-Policy violations straight to the collector.
+Point the policy's `report-uri` (or a Reporting API `report-to` endpoint) at
+`/v1/csp`; both the legacy `application/csp-report` object and the Reporting
+API's `application/reports+json` batch are accepted:
+
+```html
+policy: default-src 'self'; report-uri https://otel.example.com/v1/csp?key=...
+```
+
+Delivery is allowed cross-origin from `*.k6n.net`, `*.tornberg.me` and
+`*.knatofs.se` (the collector answers CORS preflights and echoes the origin
+for those domains only). Like the vitals beacon, the optional ingest key
+travels as `?key=` on the reporting URL, since browsers cannot attach headers
+to violation reports. Storage follows the configured store: a dedicated typed
+ClickHouse table (`csp_reports`, 90-day TTL), else the JSONL file at
+`OTEL_CSP_PATH` (default `otel-csp-reports.jsonl`).
+
+- `POST /v1/csp` (ingest key as `?key=`, CORS) — browser-reported, send nothing by hand
+- `GET /api/csp/reports?site=&directive=&q=&hours=&limit=` (authenticated), newest first
+- `GET /api/csp/summary?hours=24` (authenticated) — totals plus top directives, blocked hosts and sites
+
 ## Backend instrumentation
 
 Instrument backend services with an OpenTelemetry SDK or auto-instrumentation