Rewrite CSP host seam and middleware package marker.

Export names stay for the cloud overlay. JWT still lives only in inherited auth.py.

periscope/src/backend/middleware/__init__.py

@@ -0,0 +1,5 @@
+"""HTTP middleware package for the FastAPI app.
+
+JWT verification lives in ``auth.py`` and is imported by name from ``main``.
+This module is a package marker only — do not re-export auth from here.
+"""

periscope/src/frontend/src/lib/csp-hosts.ts

@@ -0,0 +1,17 @@
+/**
+ * CSP allow-lists consumed by next.config.ts.
+ *
+ * Self-host lists only the local API. The hosted-cloud overlay adds Clerk,
+ * Stripe, and analytics hosts here without changing export names.
+ */
+
+export const CSP_SCRIPT_HOSTS: string[] = [];
+
+export const CSP_CONNECT_HOSTS: string[] = [
+  "http://127.0.0.1:18741",
+  "http://localhost:18741",
+  "http://127.0.0.1:8080",
+  "http://localhost:8080",
+];
+
+export const CSP_FRAME_HOSTS: string[] = [];

tests/test_periscope_csp_middleware_rewrite.py

@@ -0,0 +1,28 @@
+"""CSP host seam and middleware package live under periscope/src."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+FE = ROOT / "periscope" / "src" / "frontend" / "src" / "lib" / "csp-hosts.ts"
+MW = ROOT / "periscope" / "src" / "backend" / "middleware" / "__init__.py"
+
+
+def test_csp_hosts_are_src():
+    text = FE.read_text(encoding="utf-8")
+    assert "Native Periscope overlay" not in text[:400]
+    assert "export const CSP_SCRIPT_HOSTS" in text
+    assert "export const CSP_CONNECT_HOSTS" in text
+    assert "export const CSP_FRAME_HOSTS" in text
+    assert "http://127.0.0.1:8080" in text
+    assert "http://localhost:18741" in text
+
+
+def test_middleware_package_is_src_and_does_not_export_auth():
+    text = MW.read_text(encoding="utf-8")
+    assert text.strip()
+    assert "from backend.middleware.auth" not in text
+    assert "verify_request_user" not in text
+    auth = ROOT / "periscope" / "src" / "backend" / "middleware" / "auth.py"
+    assert not auth.exists()