Fix Content Security Policy on Vercel

Vercel deployments benefit from versioned CSP in vercel.json, often scoped with source globs. Frameworks like Next.js 13+ support nonced scripts—wire nonce generation through middleware and match script-src 'nonce-...'.

Preview deployments may need relaxed frame-ancestors for design tools; isolate them on unique hostnames. CSPFixer still works against preview URLs if they are publicly reachable.