88b09521

By: Michael Lynch <git@mtlynch.io>

Revert premature S3 changes to handlers/csp.go and routes.go

Remove the S3-aware CSP logic (dynamic media origin injection) and
method receiver on enforceContentSecurityPolicy; these belong in a
later commit when S3 support is wired up.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>