fix: allow Google Books preview iframe in CSP and properly implement shareable book card

Author: devanshi14malhotra

backend/app.py

@@ -181,11 +181,12 @@ def _apply_security_headers(response):
     """Apply hardening headers to every API response."""
     csp_policy = (
         "default-src 'self'; "
-        "script-src 'self' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com; "
+        "script-src 'self' https://cdn.jsdelivr.net https://cdnjs.cloudflare.com https://www.google.com; "
         "style-src 'self' https://fonts.googleapis.com https://cdnjs.cloudflare.com; "
         "img-src 'self' data: https:; "
         "font-src 'self' https://fonts.gstatic.com https://cdnjs.cloudflare.com; "
         "connect-src 'self' https: ws: wss:; "
+        "frame-src 'self' https://books.google.com https://www.google.com; "
         "object-src 'none'; "
         "base-uri 'self'; "
         "frame-ancestors 'none'; "

frontend/js/book-preview.js

@@ -438,6 +438,7 @@ <h3>Your Reading Mood Tags</h3>
   <script src="../js/config.js"></script>
   <script src="../js/security.js"></script>
   <script src="../js/app.js"></script>
+  <script src="https://cdnjs.cloudflare.com/ajax/libs/html2canvas/1.4.1/html2canvas.min.js"></script>
   <script src="../js/book-preview.js"></script>
   <script src="../js/pwa.js"></script>
   <script src="../js/footer.js"></script>

frontend/pages/app.html

@@ -549,6 +549,7 @@ <h3>Reader Reviews</h3>
     <script src="../js/config.js"></script>
     <script src="../js/library-3d.js"></script>
     <script src="../js/app.js"></script>
+    <script src="https://cdnjs.cloudflare.com/ajax/libs/html2canvas/1.4.1/html2canvas.min.js"></script>
     <script src="../js/book-preview.js"></script>
     <script src="../js/footer.js"></script>
     <script src="../script/header-scroll.js"></script>