Site CSP Violation Reports

Reads the first-party Content-Security-Policy violation reports collected by a managed site at `/_opus/csp-report`, so a Report-Only policy can be tuned before enforcement. Point `Reporting-Endpoints: csp="/_opus/csp-report"` at the collector with site_headers and the reports land here; nothing is sent to a third party or leaves the hosting node. Results group violations by directive and blocked origin with counts, first/last seen timestamps and up to five sample pages; query strings are discarded before storage, so visitor identifiers are not retained. Add recognised legitimate origins to the policy; when the list is quiet the policy is ready to enforce. Read-only; stored reports are never cleared.