Fix mimeType, CSP settings and QR code example (#111)

- Fix RESOURCE_MIME_TYPE to match spec: "text/html;profile=mcp-app"
- Add CSP field to McpUiSandboxResourceReadyNotification type and schema
- Update basic-host to extract and pass CSP metadata from resources
- Update sandbox.ts to dynamically inject CSP meta tag into inner iframe
- Remove static CSP from sandbox.html (now dynamic based on resource metadata)
- Update QR server to use custom read_resource handler for _meta injection
- Update requirements.txt to require mcp[cli]>=1.23.3

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>

examples/basic-host/sandbox.html

@@ -2,22 +2,8 @@
 <html>
   <head>
     <meta charset="utf-8" />
-    <!-- Permissive CSP so nested content is not constrained by host CSP -->
-    <meta http-equiv="Content-Security-Policy" content="
-      default-src 'self';
-      img-src * data: blob: 'unsafe-inline';
-      media-src * blob: data:;
-      font-src * blob: data:;
-      script-src 'self'
-                 'wasm-unsafe-eval'
-                 'unsafe-inline'
-                 'unsafe-eval'
-                 blob: data: http://localhost:* https://localhost:*;
-      style-src * blob: data: 'unsafe-inline';
-      connect-src *;
-      frame-src * blob: data: http://localhost:* https://localhost:*;
-      base-uri 'self';
-    " />
+    <!-- CSP is set by serve.ts HTTP header - no meta tag needed here
+         The inner iframe's CSP is dynamically injected based on resource metadata -->
     <title>MCP-UI Proxy</title>
     <style>
       html,