fix: log index failures, and tidy the CSP and the API error response

Round-2 review findings.

- `_ensure_indexes` swallowed a `PyMongoError` with a bare `pass`. An index
  failure does not stop the app serving, but it means the lookup is a
  collection scan, which gets slow as the data grows — so it is now logged
  as a warning with the traceback.

- The Content-Security-Policy string is now a module-level `CSP` constant
  rather than inline in the response handler, and it gained
  `object-src 'none'` (the app uses no plugins). The test now also asserts
  that neither `unsafe-inline` nor `unsafe-eval` appears — either would
  defeat the point of the policy.

- `api_run` returned a bare dict for its 404 while the success path used
  `jsonify`. It is now `jsonify({"error": "not found"})` for consistency.

src/flask/mongo/repository.py

@@ -59,8 +59,14 @@ class BeerRepository:
                 [("beer_run_id", 1), ("date", 1)], name="run_date_1"
             )
         except PyMongoError:
-            # An index failure must not stop the app from serving.
-            pass
+            # An index failure must not stop the app from serving, but it
+            # should be visible: without the index the lookup is a collection
+            # scan, which gets slow as the data grows.
+            logger.warning(
+                "Could not create the Mongo indexes; the lookups will be "
+                "collection scans until they exist",
+                exc_info=True,
+            )
 
     # -- users -------------------------------------------------------------- #