Version banner, File locations section, final CSP (no unsafe-inline styles, frame-src none, object-src none)

The MTR viewer draws PDFs with pdf.js instead of an iframe the server's frame-ancestors refused.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

frontend/src/components/Layout.tsx

@@ -8,6 +8,7 @@ import { canChecklists, canStampCheck, shellScreens } from "../lib/toolAccess";
 import { LockScreen } from "./LockScreen";
 import { RoleSwitcher } from "./RoleSwitcher";
 import { TopBar } from "./TopBar";
+import { VersionBanner } from "./VersionBanner";
 
 function chipClass(s: Screen): string {
   if (s === "admin") return "rchip admin";
@@ -47,7 +48,7 @@ export function Layout() {
 
   return (
     <>
-      <TopBar nav={me && !locked ? <RoleSwitcher screens={screens} active={active} /> : null}>
+      <TopBar nav={me && !locked ? <RoleSwitcher screens={screens} active={active} /> : null} banner={<VersionBanner />}>
         {me ? (
           <>
             <b className="uname">{me.user.display_name}</b>