Staff file proxy: harden against SVG XSS and SSRF

- Allowlist inline MIME types (png/jpeg/gif/webp/pdf only); everything
  else, including SVG and HTML, served as application/octet-stream
  with content-disposition: attachment.
- X-Content-Type-Options: nosniff and a restrictive CSP on every response.
- Validate the upstream URL Civi returns: must match CIVI_BASE_URL origin
  before we attach basic-auth creds and follow it. redirect: manual to
  prevent off-host hops.
- Drop SVG from the client's inline-image list (server forces download).

components/StaffReportView.tsx

@@ -247,7 +247,9 @@ function FilePreviewItem({
   const name = v.file_name ?? `file-${id}`;
   const href = `/api/staff/file?id=${encodeURIComponent(id)}&key=${encodeURIComponent(authKey)}`;
   const ext = (name.split(".").pop() ?? "").toLowerCase();
-  const isImage = ["png", "jpg", "jpeg", "gif", "webp", "svg"].includes(ext);
+  // SVG omitted on purpose — the proxy forces SVG to download (XSS hardening),
+  // so an inline <img> here would just show a broken thumbnail.
+  const isImage = ["png", "jpg", "jpeg", "gif", "webp"].includes(ext);
   const isPdf = ext === "pdf";
 
   return (