Remove django-csp package - CSP now handled by NPM

Since Nginx Proxy Manager is handling Content Security Policy headers
at the reverse proxy level, removed django-csp from Django to avoid
duplication and simplify configuration.

Changes:
- Removed django-csp from requirements.txt
- Removed CSPMiddleware from middleware stack
- Removed CSP_* settings from selfhosted.py
- Added comment noting CSP is configured in NPM

CSP is now exclusively managed in NPM's Advanced configuration with:
- default-src 'self'
- script-src/style-src 'self' 'unsafe-inline' (for Django admin)
- img-src 'self' data: https:
- frame-ancestors 'none'
- And other security directives

This keeps configuration in one place (NPM) and eliminates
dependency on django-csp package.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

config/settings/base.py

@@ -36,7 +36,6 @@ INSTALLED_APPS = [
 
 MIDDLEWARE = [
     'django.middleware.security.SecurityMiddleware',
-    'csp.middleware.CSPMiddleware',  # Content Security Policy
     'whitenoise.middleware.WhiteNoiseMiddleware',
     'corsheaders.middleware.CorsMiddleware',
     'django.contrib.sessions.middleware.SessionMiddleware',

config/settings/selfhosted.py

@@ -135,18 +135,8 @@ SECURE_BROWSER_XSS_FILTER = True
 SECURE_CONTENT_TYPE_NOSNIFF = True
 X_FRAME_OPTIONS = 'DENY'  # Prevent clickjacking
 
-# Content Security Policy (CSP)
+# Note: Content Security Policy (CSP) is configured in Nginx Proxy Manager
-# Helps prevent XSS attacks by controlling what resources can load
+# See NPM Advanced config for CSP header configuration
-# This policy allows Django admin to function while providing good security
-CSP_DEFAULT_SRC = ("'self'",)
-CSP_SCRIPT_SRC = ("'self'", "'unsafe-inline'")  # unsafe-inline needed for Django admin
-CSP_STYLE_SRC = ("'self'", "'unsafe-inline'")   # unsafe-inline needed for Django admin
-CSP_IMG_SRC = ("'self'", "data:", "https:")     # Allow images from HTTPS sources
-CSP_FONT_SRC = ("'self'", "data:")
-CSP_CONNECT_SRC = ("'self'",)
-CSP_FRAME_ANCESTORS = ("'none'",)  # Equivalent to X-Frame-Options: DENY
-CSP_BASE_URI = ("'self'",)
-CSP_FORM_ACTION = ("'self'",)
 
 # Static files
 STATICFILES_STORAGE = 'whitenoise.storage.CompressedManifestStaticFilesStorage'

requirements.txt

@@ -28,6 +28,3 @@ Pillow>=10.0.0
 # Production
 gunicorn>=21.0.0
 whitenoise>=6.6.0
-
-# Security
-django-csp>=3.8