Enhance development and production scripts in package.json and update README for CSP testing

- Added new npm scripts for production testing with Content Security Policy: `dev:prod` and `preview:prod`.
- Updated README.md to include detailed instructions for development, production testing, and a pre-deployment checklist to ensure security settings are verified before deployment.

server.js

@@ -25,7 +25,16 @@ app.use((req, res, next) => {
   if (process.env.ENABLE_SSR_CSP === '1') {
     res.setHeader(
       'Content-Security-Policy',
-      "default-src 'self' https://365devnet.eu https://*.365devnet.eu; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' 'nonce-astro' https://chat.365devnet.eu; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://cdn.pixabay.com https://raw.githubusercontent.com; font-src 'self' data:; connect-src 'self' https://365devnet.eu https://chat.365devnet.eu wss://chat.365devnet.eu; frame-src https://chat.365devnet.eu; frame-ancestors 'none'; base-uri 'self'; form-action 'self'"
+      "default-src 'self' https://365devnet.eu https://*.365devnet.eu; " +
+      "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://chat.365devnet.eu; " +
+      "style-src 'self' 'unsafe-inline'; " +
+      "img-src 'self' data: https: blob:; " +
+      "font-src 'self' data:; " +
+      "connect-src 'self' https://365devnet.eu https://*.365devnet.eu https://chat.365devnet.eu https://git.365devnet.eu wss://chat.365devnet.eu; " +
+      "frame-src 'self' https://chat.365devnet.eu; " +
+      "frame-ancestors 'none'; " +
+      "base-uri 'self'; " +
+      "form-action 'self'"
     );
   }
   next();