Add honest SDA deployment-source evidence (#3)

fix: allow huggingface.co to frame the Space (App-tab embed was blocked by frame-ancestors 'self')

harden(sda): add CSP/HSTS/nosniff/Referrer + clean Server banner via server.py; same files/port (non-breaking)