fix: generate CSP from runtime storage env for self-hosted MinIO

Move Content-Security-Policy generation to proxy.ts so R2_PRESIGN_ENDPOINT
is included at request time instead of being frozen at image build time.
Document reverse-proxy layouts for Docker self-hosting and copy proxy.ts
into the Docker image.

Closes #17

proxy.ts

@@ -0,0 +1,20 @@
+import { NextResponse } from 'next/server';
+import { buildContentSecurityPolicy } from '@/lib/content-security-policy';
+
+export function proxy() {
+  const response = NextResponse.next();
+  response.headers.set('Content-Security-Policy', buildContentSecurityPolicy());
+  return response;
+}
+
+export const config = {
+  matcher: [
+    /*
+     * Match all request paths except:
+     * - _next/static (static files)
+     * - _next/image (image optimization files)
+     * - favicon.ico (favicon file)
+     */
+    '/((?!_next/static|_next/image|favicon.ico).*)',
+  ],
+};