Training dashboard: use an exact static-asset allowlist for strict CSP
Observation (2026-09-07, source: ender-inference training-service implementation): serving the evaluator dashboard through an exact filename→MIME allowlist, rather than a generic static directory, cleanly supports strict same-origin CSP and blocks traversal/accidental file exposu…