Secure textbook previews by isolating inline scripts from main domain CSP

[harsharajkumar-273]

Helmet CSP is currently disabled in server.ts because PreTeXt compiles require inline scripts. We should isolate the preview to prevent XSS risks, perhaps by using a separate sandboxed subdomain or a stricter iframe sandbox configuration.

[sanket1035]

Hi @harsharajkumar-273 👋
I'd like to work on this issue. I've gone through the repo structure and understand the context here — I have experience with [React/Node/Express/Prisma/Docker — jo bhi relevant ho is issue ke liye] and can get started right away.
If assigned, I'll make sure to:
Follow the existing code style and architecture conventions
Add proper tests/validation where applicable
Keep the PR focused and well-documented with clear commit messages
I'll ensure the PR quality is excellent before requesting review. Please assign this to me — happy to share my approach in more detail if needed.
Thanks!

[github-actions]

Hi @sanket1035, you have been successfully assigned to this issue! Happy coding 🚀