merge: restrictive CSP and narrowed asset scope (C1, C2)

Set a CSP with script-src 'self' (Tauri nonces the one inline bootstrap script),
object-src/frame-src 'none', and necessarily-permissive img/media/connect for the
user-supplied Jellyfin origin. Narrow assetProtocol $APPDATA/** -> thumbnails/**,
which is convertFileSrc's only remaining caller.

Conflict resolution: scripts/extract-traces.test.ts pinned counts summed rather
than side-picked — DR-189 and DR-198 were added independently on two branches,
so DR 187 -> 189 and total 330 -> 332. docs/traceability.md regenerated.

scripts/extract-traces.test.ts

@@ -264,10 +264,12 @@ describe("live requirements.md", () => {
 
     expect(defined.UR).toBe(75);
     expect(defined.IR).toBe(32);
-    // 188 since DR-189 was given the definition its TRACES comments in
-    // VideoPlayer.svelte / controlsVisibility.ts had always referenced.
-    expect(defined.DR).toBe(188);
+    // 189 = 187 + two independently-added requirements that landed together:
+    // DR-189 (the definition its TRACES comments in VideoPlayer.svelte /
+    // controlsVisibility.ts had always referenced) and DR-198 (asset-protocol
+    // scope). Each branch bumped 187 -> 188 for its own; merged, they sum.
+    expect(defined.DR).toBe(189);
     expect(defined.JA).toBe(36);
-    expect(defined.total).toBe(331);
+    expect(defined.total).toBe(332);
   });
 });