Declare file input parameters and configure CSP, locale, and user-context metadata correctly on an Apps SDK MCP server

Documented steps

1. Declare file inputs by listing TOP-LEVEL input-schema field names in `_meta["openai/fileParams"]` (a string array); nested file fields are not supported.
2. Expect each declared file param to arrive as an object with required `download_url` and `file_id`, plus optional `mime_type` and `file_name`.
3. Return files by reference (e.g. a `file_uri` field) inside `structuredContent` rather than embedding inline binary data.
4. Set `_meta.ui.csp` on the widget resource with `connectDomains` (fetch/XHR hosts), `resourceDomains` (images, fonts, scripts), and optional `frameDomains` for iframes.
5. Set `_meta.ui.domain` to a unique dedicated origin for the widget sandbox — required for app submission.
6. Read the client's requested locale from `_meta["openai/locale"]` (BCP 47) and resolve it with RFC 4647 matching for number and date formatting.
7. Treat `_meta["openai/userAgent"]`, `_meta["openai/userLocation"]`, `_meta["openai/subject"]`, `_meta["openai/session"]`, and `_meta["openai/organization"]` as analytics/formatting hints only — enforce authorization server-side against a validated token.
8. Official docs: https://developers.openai.com/apps-sdk/build/mcp-server and https://developers.openai.com/apps-sdk/reference