Rewrite CSP host seam and middleware package marker.

Export names stay for the cloud overlay. JWT still lives only in inherited auth.py.

periscope/src/backend/middleware/__init__.py

@@ -0,0 +1,5 @@
+"""HTTP middleware package for the FastAPI app.
+
+JWT verification lives in ``auth.py`` and is imported by name from ``main``.
+This module is a package marker only — do not re-export auth from here.
+"""

periscope/src/frontend/src/lib/csp-hosts.ts

@@ -0,0 +1,17 @@
+/**
+ * CSP allow-lists consumed by next.config.ts.
+ *
+ * Self-host lists only the local API. The hosted-cloud overlay adds Clerk,
+ * Stripe, and analytics hosts here without changing export names.
+ */
+
+export const CSP_SCRIPT_HOSTS: string[] = [];
+
+export const CSP_CONNECT_HOSTS: string[] = [
+  "http://127.0.0.1:18741",
+  "http://localhost:18741",
+  "http://127.0.0.1:8080",
+  "http://localhost:8080",
+];
+
+export const CSP_FRAME_HOSTS: string[] = [];