Version banner, File locations section, final CSP (no unsafe-inline styles, frame-src none, object-src none)

The MTR viewer draws PDFs with pdf.js instead of an iframe the server's frame-ancestors refused.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

frontend/src/components/TopBar.tsx

@@ -41,12 +41,15 @@ interface TopBarProps {
   nav?: ReactNode;
   /** Right-hand side: the signed-in user, the role chip, Account and Sign out. */
   children?: ReactNode;
+  /** A strip above the bar, inside the sticky header so it stays in view (the build-version banner). */
+  banner?: ReactNode;
 }
 
 /** Sticky shop header. Same markup classes as the old page's header.top. */
-export function TopBar({ nav, children }: TopBarProps) {
+export function TopBar({ nav, children, banner }: TopBarProps) {
   return (
     <header className="top">
+      {banner}
       <div className="top-in">
         <Link className="brand" to="/" aria-label="Packet Station home">
           <img alt="PESCO" src={logo} width={119} height={34} />