feat(static): add React Expo CSP parity

[vatsalyagoel]

Adds React/Expo static-site CSP support across policy generation, CLI workflows, and MCP tools, including scoped style-src-attr fallback behavior without broad script/style unsafe-inline allowances.

• Add React/Expo static profile detection and static hash policy generation behavior
• Update policy optimization and scoring for scoped style attribute fallback tradeoffs
• Expose static profile controls through CLI commands and documentation
• Add MCP parity for cookies, nonce/strict-dynamic controls, hash_static, scoped session comparison, and updated MCP docs
• Add focused unit and integration coverage for static, CLI, policy, and MCP behavior

Validation:

• npx prettier --check ...
• git diff --check
• LSP diagnostics on changed MCP TypeScript files
• npm run typecheck
• npm run build
• npm run lint
• npm run test (41 files, 1153 tests)

Notes:

• No PR template was found.
• Excluded from this PR: package-lock.json and internal-docs/csp-is-dead.md.