Fix mimeType, CSP settings and QR code example

[antonpk1]

Summary

• Fix RESOURCE_MIME_TYPE constant to match spec: text/html;profile=mcp-app (was incorrectly text/html;profile=mcp)
• Add CSP field to McpUiSandboxResourceReadyNotification type and schema for passing security policy from resources to sandbox
• Update basic-host to extract and pass CSP metadata from resource _meta.ui.csp
• Update sandbox.ts to dynamically inject CSP meta tag into inner iframe based on resource metadata
• Remove static CSP from sandbox.html (now dynamic per-resource)
• Update QR server to use custom read_resource handler for _meta injection (FastMCP workaround)
• Update requirements.txt to require mcp[cli]>=1.23.3

Test plan

• Build project with npm run build
• Start QR server: cd examples/qr-server && python server.py
• Start basic-host: cd examples/basic-host && SERVERS='["http://localhost:3108/mcp"]' bun serve.ts
• Open http://localhost:8080, select QR Server, call generate_qr with {"text": "https://example.com"}
• Verify QR code renders in widget (SDK loads from unpkg.com via CSP)

🤖 Generated with Claude Code

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/modelcontextprotocol/ext-apps/@modelcontextprotocol/ext-apps@111

commit: b6cf699

[ochafik]

Thanks Anton!