fix(admin): normalize line endings before hashing CSP script

[SomSamantray]

Summary

• Fixes CSP hash mismatch blocks the admin shell and auth confirm page on CRLF checkouts #232: a CRLF checkout (e.g. Windows with core.autocrlf=true) breaks the admin shell's inline script, because the server hashes the raw on-disk bytes of the script for its CSP script-src 'sha256-...' header, while browsers normalize \r\n/\r to \n before hashing inline script content per spec — the two hashes never match, so the CSP silently blocks the script.
• Extracts the hash computation into an exported hashAdminScript() helper (plugins/admin/src/index.ts) that normalizes line endings before hashing, so the computed CSP hash always matches what a browser will compute regardless of on-disk line-ending style.

Test plan

• Added plugins/admin/test/csp-hash.test.ts:
  • CRLF and bare-CR variants of a script hash identically to their LF equivalent.
  • Differing content still produces differing hashes (sanity check).
  • The live server's content-security-policy response header's script-src hash matches hashAdminScript() computed over the real on-disk script.
• Verified red-before-fix: temporarily removed the normalization and confirmed exactly the CRLF/CR-specific assertions fail (the LF-only and content-difference assertions still pass), then restored the fix and reran green.
• Full admin plugin suite: NODE_ENV=test ALLOW_UNSIGNED_TEST_IDENTITY=1 npm test → 83/83 passing, no regressions.
• npm run typecheck → clean.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}