The CSP was silently off under Astro 7

Astro 7 moved `csp` out of `experimental` — but to `security.csp`, not to
the top level, and I put it at the top level. Astro's config schema drops
keys it does not know without a word: the build stayed green, the types
stayed green, and every response went out with no Content-Security-Policy
at all. Only looking at a live response header showed it.

Fixed, and now guarded: tests/config.test.ts reads the config and asserts
the policy sits where Astro actually reads it. Checked that the test goes
red against the broken config before trusting it green against this one.

Verified on a running instance: the header is back, with the same
per-script hashes as before.

astro.config.mjs

@@ -10,22 +10,27 @@ export default defineConfig({
   // CSRF: handled by our own SameSite=Lax session cookie. Astro's checkOrigin
   // breaks multipart uploads behind a reverse proxy, because the proxy speaks
   // http to the app while the browser spoke https and the origins no longer match.
-  security: { checkOrigin: false },
+  //
   // Content-Security-Policy with hashes instead of 'unsafe-inline': Astro computes
   // the hash of every inline script and style it emits, at build time. The remaining
   // directives are set by the middleware (src/middleware.ts).
-  // Graduated out of `experimental` in Astro 7.
-  csp: {
-    directives: [
-      "default-src 'self'",
-      "img-src 'self' data: blob:",
-      "font-src 'self'",
-      "connect-src 'self'",
-      "object-src 'none'",
-      "base-uri 'self'",
-      "form-action 'self'",
-      "frame-ancestors 'none'",
-    ],
+  // Astro 7 graduated this out of `experimental` and it lives under `security` now.
+  // Careful: a top-level `csp` key is swallowed without a warning and the site then
+  // runs with no policy at all.
+  security: {
+    checkOrigin: false,
+    csp: {
+      directives: [
+        "default-src 'self'",
+        "img-src 'self' data: blob:",
+        "font-src 'self'",
+        "connect-src 'self'",
+        "object-src 'none'",
+        "base-uri 'self'",
+        "form-action 'self'",
+        "frame-ancestors 'none'",
+      ],
+    },
   },
   server: { host: true, port: Number(process.env.PORT) || 4321 },
   vite: {