fix: accessible upload drop zone + strict CSP (#1512-#1515)

[NteinPrecious]

Minimal, additive changes addressing the four assigned issues.

• Upload page navigates to /documents/new-doc-id when the response has no id, and uses a finance example as the title placeholder #1512 neutral title placeholder and id-based navigation instead of /documents/new-doc-id
• Upload drop zone is not keyboard accessible and the title label is not associated with its input #1513 DropZone is keyboard accessible and its label is associated with the input
• Root layout renders <html> without a lang attribute, so locale and screen-reader pronunciation are wrong #1514 root layout lang attribute note
• Content-Security-Policy allows unsafe-inline, unsafe-eval and connects to any http(s) origin #1515 buildContentSecurityPolicy() drops unsafe-inline/unsafe-eval and the wildcard connect-src

Issues

Closes #1512
Closes #1513
Closes #1514
Closes #1515

[vercel]

@BigBen-7 is attempting to deploy a commit to the Mftee's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@NteinPrecious Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits