Local flag header background + strict nonce CSP / isolation headers

[DotNetRussell]

Summary

• Use frontend/public/images/american_flag.jpg for the hero header background (replaces the ftcdn CDN URL).
• Add Next.js 16 proxy.ts Content-Security-Policy with per-request nonces — production no longer allows script-src 'unsafe-inline' / 'unsafe-eval'.
• Caddy sets COOP / CORP / COEP (credentialless) and no longer re-declares CSP (would defeat nonces).
• Theme bootstrap script uses the nonce from the proxy.

Note on the flag asset

The JPG is present locally; if the binary is not yet on this branch due to upload limits, attach frontend/public/images/american_flag.jpg before merge or scp it into the frontend image. CSS already points at /images/american_flag.jpg.

Test plan

• npm test (frontend)
• npm run build (shows Proxy + dynamic routes)
• After deploy: curl -sI https://operationchildshield.org/ | grep -iE 'content-security|cross-origin'
• Confirm CSP has nonce and no unsafe-inline on script-src
• Confirm header shows local flag art