CSP Structural Audit

Parse one Content-Security-Policy and report its structure, with the fallback rules applied. A fetch directive absent while default-src is present is reported as covered; base-uri and frame-ancestors do not fall back, so absence there is a finding. unsafe-inline alongside a nonce is reported differently from unsafe-inline alone, since supporting browsers ignore it. A repeated directive is reported because only the first takes effect. Structure only, not an assessment of adequacy.