Fix mimeType, CSP settings and QR code example (#111)

- Fix RESOURCE_MIME_TYPE to match spec: "text/html;profile=mcp-app"
- Add CSP field to McpUiSandboxResourceReadyNotification type and schema
- Update basic-host to extract and pass CSP metadata from resources
- Update sandbox.ts to dynamically inject CSP meta tag into inner iframe
- Remove static CSP from sandbox.html (now dynamic based on resource metadata)
- Update QR server to use custom read_resource handler for _meta injection
- Update requirements.txt to require mcp[cli]>=1.23.3

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>

src/app.ts

@@ -79,7 +79,7 @@ export const RESOURCE_URI_META_KEY = "ui/resourceUri";
 /**
  * MIME type for MCP UI resources.
  */
-export const RESOURCE_MIME_TYPE = "text/html;profile=mcp";
+export const RESOURCE_MIME_TYPE = "text/html;profile=mcp-app";
 
 /**
  * Options for configuring App behavior.

src/types.ts

@@ -248,6 +248,13 @@ export interface McpUiSandboxResourceReadyNotification {
     html: string;
     /** Optional override for the inner iframe's sandbox attribute */
     sandbox?: string;
+    /** CSP configuration from resource metadata */
+    csp?: {
+      /** Origins for network requests (fetch/XHR/WebSocket) */
+      connectDomains?: string[];
+      /** Origins for static resources (scripts, images, styles, fonts) */
+      resourceDomains?: string[];
+    };
   };
 }
 
@@ -260,6 +267,12 @@ export const McpUiSandboxResourceReadyNotificationSchema = z.object({
   params: z.object({
     html: z.string(),
     sandbox: z.string().optional(),
+    csp: z
+      .object({
+        connectDomains: z.array(z.string()).optional(),
+        resourceDomains: z.array(z.string()).optional(),
+      })
+      .optional(),
   }),
 });