merge: restrictive CSP and narrowed asset scope (C1, C2)

Set a CSP with script-src 'self' (Tauri nonces the one inline bootstrap script),
object-src/frame-src 'none', and necessarily-permissive img/media/connect for the
user-supplied Jellyfin origin. Narrow assetProtocol $APPDATA/** -> thumbnails/**,
which is convertFileSrc's only remaining caller.

Conflict resolution: scripts/extract-traces.test.ts pinned counts summed rather
than side-picked — DR-189 and DR-198 were added independently on two branches,
so DR 187 -> 189 and total 330 -> 332. docs/traceability.md regenerated.

src/lib/services/imageCache.ts

@@ -41,7 +41,10 @@ export async function getCachedImageUrl(
     const cachedPath = await commands.thumbnailGetCached(itemId, imageType, tag);
 
     if (cachedPath) {
-      // Convert file path to asset URL for Tauri
+      // Convert file path to asset URL for Tauri. This is the only remaining
+      // convertFileSrc caller, which is why the asset-protocol scope is narrowed
+      // to $APPDATA/thumbnails/** — a path outside it resolves to nothing.
+      // TRACES: UR-012 | DR-134, DR-198
       return convertFileSrc(cachedPath);
     }
   } catch (e) {