fix: Swagger UI CSP 완화하여 리소스 로딩 허용

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

pkg/middleware/security.go

@@ -1,6 +1,10 @@
 package middleware
 
-import "github.com/gofiber/fiber/v2"
+import (
+	"strings"
+
+	"github.com/gofiber/fiber/v2"
+)
 
 // SecurityHeaders sets common HTTP security headers on every response.
 func SecurityHeaders(c *fiber.Ctx) error {
@@ -8,7 +12,13 @@ func SecurityHeaders(c *fiber.Ctx) error {
 	c.Set("X-Frame-Options", "DENY")
 	c.Set("X-XSS-Protection", "0")
 	c.Set("Referrer-Policy", "strict-origin-when-cross-origin")
-	c.Set("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'")
+
+	if strings.HasPrefix(c.Path(), "/swagger") {
+		c.Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data:; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'")
+	} else {
+		c.Set("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'")
+	}
+
 	c.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains")
 	return c.Next()
 }