fix(media): allow direct inline playback

[aadilr]

What

• Select a least-privilege CSP by stored MIME type.
• Allow only same-origin media for video and same-origin images for image blobs.
• Apply the policy consistently to full 200 and ranged 206 responses.
• Preserve default-src none for downloadable attachments.

Why

Direct navigation to a Buzz-hosted MP4 currently creates a browser-native video element, but the response header default-src none falls back to media-src none and blocks the element from loading its own URL. The files and range responses are valid; the response policy is the failure.

Verification

• cargo fmt --check
• cargo check -p buzz-relay --lib
• cargo clippy -p buzz-relay --lib -- -D warnings
• Reproduced on the reported live MP4 in Chromium: currentSrc empty, readyState 0, networkState 3, and an explicit CSP console violation.
• Re-ran the same live asset while substituting the patched response header: currentSrc populated, readyState 4, duration 6.533333, and no media error.
• Both reported MP4s were SHA-256 matched, ffprobe validated as H.264 avc1/yuv420p, and decoded end-to-end with ffmpeg.

Focused cargo test -p buzz-relay csp was attempted locally but could not compile the Mesh dev dependency because this machine lacks pkg-config and OpenSSL development headers. The relay library and strict Clippy compilation both pass.

Live path

This needs to reach the relay behind buzz.sovereignfirm.com. Merge alone does not make it live. The documented upstream path is main -> relay-v* release via just release-relay -> the docker.yml workflow publishes ghcr.io/block/buzz -> the Sovereign Firm relay service consumes the released image. This PR does not deploy.