By: Michael Lynch <git@mtlynch.io>
Revert premature S3 changes to handlers/csp.go and routes.go Remove the S3-aware CSP logic (dynamic media origin injection) and method receiver on enforceContentSecurityPolicy; these belong in a later commit when S3 support is wired up. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>