Version banner, File locations section, final CSP (no unsafe-inline styles, frame-src none, object-src none)

The MTR viewer draws PDFs with pdf.js instead of an iframe the server's frame-ancestors refused.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

frontend/src/screens/admin/StorageTab.tsx

@@ -1,9 +1,10 @@
-// Admin: the assets volume, the virus scanner and the open alerts (phase 4).
+// Admin: the assets volume, the virus scanner, the archive folder (phase 10) and the open alerts (phase 4).
 import { useState } from "react";
 import { storageApi } from "../../api/storage";
 import type { AlertRow } from "../../api/types";
 import { errorText, fmtBytes, fmtTime } from "../../lib/format";
 import { useLoad } from "../../lib/useLoad";
+import { FileLocations } from "./FileLocations";
 
 const whoName = (a: AlertRow["acknowledged_by"]) => (a && typeof a === "object" ? a.display_name : (a ?? ""));
 
@@ -96,6 +97,8 @@ export function StorageTab() {
         )}
       </section>
 
+      <FileLocations />
+
       <section className="sec" aria-labelledby="alerts-h">
         <div className="sec-h">
           <h3 id="alerts-h">Open alerts</h3>