Fix CSV uploads behind Hugging Face proxy

Disable Streamlit direct-origin XSRF and CORS enforcement because Hugging Face terminates TLS and proxies the public Space origin.

.streamlit/config.toml

@@ -1,11 +1,15 @@
-[theme]
-primaryColor = "#6045D8"
-backgroundColor = "#FBFAFF"
-secondaryBackgroundColor = "#F4F1FF"
-textColor = "#172033"
-font = "sans serif"
-
-[server]
-headless = true
-maxUploadSize = 25
-
+[theme]
+primaryColor = "#6045D8"
+backgroundColor = "#FBFAFF"
+secondaryBackgroundColor = "#F4F1FF"
+textColor = "#172033"
+font = "sans serif"
+
+[server]
+headless = true
+maxUploadSize = 25
+# Hugging Face terminates TLS and forwards requests through its Space proxy.
+# Streamlit cannot validate its direct-origin XSRF cookie across that boundary,
+# which otherwise makes the file-upload endpoint return HTTP 403.
+enableXsrfProtection = false
+enableCORS = false