Self-host front-end libraries, minimal sign-in header and CSP

- sign-in pages load only what they use (include_login_header.php, ajax_core.js)
- every library, font and data file served from assets/vendor with pinned
  versions (VERSIONS.json); no CDN at runtime
- Content-Security-Policy on app, sign-in and landing pages
- remove httpbin Dropzone target and source-map references

app/login/register.php

@@ -13,13 +13,13 @@
     $_SESSION['csrf_token'] = bin2hex(random_bytes(32));
   }
 
-  require '../include_header.php';
+  require __DIR__ . '/include_login_header.php';
 ?>
 
 <body>
 
   <!-- zxcvbn JS: client-side password strength scoring, no server round-trip -->
-  <script src="https://cdn.jsdelivr.net/npm/zxcvbn@4.4.2/dist/zxcvbn.js"></script>
+  <script src="<?php echo $server_url?>assets/vendor/zxcvbn/4.4.2/zxcvbn.js"></script>
 
   <div class="container d-flex align-items-center justify-content-center min-vh-100 py-5">
     <div class="card" style="max-width:520px; width:100%;">