fix: log index failures, and tidy the CSP and the API error response

Round-2 review findings.

- `_ensure_indexes` swallowed a `PyMongoError` with a bare `pass`. An index
  failure does not stop the app serving, but it means the lookup is a
  collection scan, which gets slow as the data grows — so it is now logged
  as a warning with the traceback.

- The Content-Security-Policy string is now a module-level `CSP` constant
  rather than inline in the response handler, and it gained
  `object-src 'none'` (the app uses no plugins). The test now also asserts
  that neither `unsafe-inline` nor `unsafe-eval` appears — either would
  defeat the point of the policy.

- `api_run` returned a bare dict for its 404 while the success path used
  `jsonify`. It is now `jsonify({"error": "not found"})` for consistency.

tests/test_app.py

@@ -491,9 +491,13 @@ def test_security_headers_are_set(logged_in):
     assert csp is not None
     assert "default-src 'self'" in csp
     assert "script-src 'self'" in csp
+    assert "object-src 'none'" in csp
     assert "frame-ancestors 'none'" in csp
     # No CDN is used, so nothing external should be allowed.
     assert "https://" not in csp
+    # 'unsafe-inline' would defeat the point of the policy.
+    assert "unsafe-inline" not in csp
+    assert "unsafe-eval" not in csp
 
 
 def test_security_headers_are_set_on_the_login_page(client):