Rewrite CSP host seam and middleware package marker.

Export names stay for the cloud overlay. JWT still lives only in inherited auth.py.

tests/test_periscope_csp_middleware_rewrite.py

@@ -0,0 +1,28 @@
+"""CSP host seam and middleware package live under periscope/src."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+FE = ROOT / "periscope" / "src" / "frontend" / "src" / "lib" / "csp-hosts.ts"
+MW = ROOT / "periscope" / "src" / "backend" / "middleware" / "__init__.py"
+
+
+def test_csp_hosts_are_src():
+    text = FE.read_text(encoding="utf-8")
+    assert "Native Periscope overlay" not in text[:400]
+    assert "export const CSP_SCRIPT_HOSTS" in text
+    assert "export const CSP_CONNECT_HOSTS" in text
+    assert "export const CSP_FRAME_HOSTS" in text
+    assert "http://127.0.0.1:8080" in text
+    assert "http://localhost:18741" in text
+
+
+def test_middleware_package_is_src_and_does_not_export_auth():
+    text = MW.read_text(encoding="utf-8")
+    assert text.strip()
+    assert "from backend.middleware.auth" not in text
+    assert "verify_request_user" not in text
+    auth = ROOT / "periscope" / "src" / "backend" / "middleware" / "auth.py"
+    assert not auth.exists()