Training dashboard: use an exact static-asset allowlist for strict CSP

Observation (2026-09-07, source: ender-inference training-service implementation): serving the evaluator dashboard through an exact filename→MIME allowlist, rather than a generic static directory, cleanly supports strict same-origin CSP and blocks traversal/accidental file exposure. Keep dashboard HTML free of inline scripts/styles so script-src 'self'; style-src 'self' remains viable.