fix(csp): disable Vite module preload polyfill to prevent inline script violation

The polyfill was injected as an inline script at build time, causing a hard
CSP block under script-src 'self'. All browsers that support ES modules also
support modulepreload natively, so the polyfill is unnecessary.

client/vite.config.js

@@ -90,6 +90,7 @@ export default defineConfig({
   ],
   build: {
     sourcemap: false,
+    modulePreload: { polyfill: false },
   },
   server: {
     port: 5173,