fix: log index failures, and tidy the CSP and the API error response

Round-2 review findings.

- `_ensure_indexes` swallowed a `PyMongoError` with a bare `pass`. An index
  failure does not stop the app serving, but it means the lookup is a
  collection scan, which gets slow as the data grows — so it is now logged
  as a warning with the traceback.

- The Content-Security-Policy string is now a module-level `CSP` constant
  rather than inline in the response handler, and it gained
  `object-src 'none'` (the app uses no plugins). The test now also asserts
  that neither `unsafe-inline` nor `unsafe-eval` appears — either would
  defeat the point of the policy.

- `api_run` returned a bare dict for its 404 while the success path used
  `jsonify`. It is now `jsonify({"error": "not found"})` for consistency.

src/flask/views/brews.py

@@ -196,7 +196,7 @@ def api_run(run_id: str):
     """JSON detail of a single run."""
     run = repo().run(run_id)
     if run is None:
-        return {"error": "not found"}, 404
+        return jsonify({"error": "not found"}), 404
 
     meta = repo().run_metadata(run_id)
     summary = run_summary(run, og_override=meta.get("og_points"))