fix(directory): apply configured head HTML on public directory pages #1

Problem

The /u/{handle} and /team/{slug} directory handler loads the tracking settings and assigns HeadHTML to directoryPageData, but internal/handler/templates/directory.html does not render it. CSS entered in Settings → Tracking → Code injection (head) affects booking pages but not directory pages. Unlike the booking and manage renderers, renderDirectory also does not set the publicCSP(track) response header.

Proposed upstream fix

1. Render the already-loaded HeadHTML once in the directory template's <head>, in the same relative position used by the public booking page. Keep the existing admin-only setting boundary and the explicit trusted-HTML conversion in the handler; do not accept HTML from a directory URL or other unauthenticated input.
2. Set Content-Security-Policy: publicCSP(track) in renderDirectory, matching the book and manage renderers. This preserves the strict policy when no injection/native tag is configured and applies the configured policy when head code is present.
3. Add handler tests for both person and team routes. Verify the configured HTML appears exactly once in <head>, the appropriate CSP is set for both empty and populated settings, and normal directory content still renders.

This addresses the complete page behavior. The local change that inserts only {{.HeadHTML}} fixes the immediate CSS symptom but omits the public page CSP contract.

Acceptance criteria

• Configured head CSS applies on both /u/{handle} and /team/{slug}.
• Empty head HTML preserves the strict public CSP and normal rendering.
• Configured head HTML receives the same CSP behavior as the booking and manage pages.
• Tracking tags and existing directory links still work.

Observed in a local source build; separate from the SMTP change on feat/smtp-auth-login.