fix(learner): remove the SPA proxy; CSP as a meta tag in index.html (ruling R16)

The proxy, its internal server, Unix socket and NO_PROXY changes are gone; main.ts serves the HTML
import directly again. apps/web/index.html carries the SPA policy as <meta http-equiv=CSP> ahead of every
script (script-src 'self' plus the hash of Bun's dev-server helper, no unsafe-inline/eval; no
frame-ancestors, which meta cannot carry). Dev HMR connects under it. The runner frame keeps its header CSP.

Tests: the served index.html (prod and dev, in a subprocess) has the meta policy and every inline script
is hash-covered; the XSS browser test fails with the sanitizer disabled and passes with it, and the meta
CSP alone blocks unsanitized handlers (with a no-CSP control); no source assigns proxy env vars, and the
feature leaves them untouched at runtime. Contract request 5 asks core for frame-ancestors/X-Frame-Options.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/feature-learner/src/index.ts

@@ -1,7 +1,6 @@
 // Server
 export { migrationsDirs, runMigrations } from "./server/migrate";
 export { learnerFeature } from "./server/feature";
-export { spaWithCsp, spaCsp } from "./server/spa";
 // Browser (also available without the server half as "@stc/feature-learner/web")
 export { learnerWeb, LessonView, type LessonViewProps, ensureLearnerStyles } from "./web";
 // Shared JSON shapes