fix(server): enforce app-wide browser security headers (#1541)

[serenakeyitan]

Closes #1541 (audit finding SEC-041).

What

Every HTTP response the server produces now carries an app-wide browser security header set, stamped by a single Fastify onSend hook registered in buildApp:

Header	Value
Content-Security-Policy	enforced least-privilege policy (details below)
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
Referrer-Policy	strict-origin-when-cross-origin
Permissions-Policy	camera=(), microphone=(), geolocation=(), payment=()
X-Frame-Options	DENY (plus CSP frame-ancestors 'none')

The onSend placement means the layer reaches every reply shape: SPA shell, SPA deep-link fallback, API JSON, API 404s, asset 404s, and error-handler replies.

CSP design

• Code owns the policy shape; config owns only origin allowlists. Keyword sources ('self', 'none', data:, blob:) are hardcoded in buildContentSecurityPolicy; the shared config schema validates each configured entry as an https/wss origin (wildcard subdomains allowed) and rejects keyword/scheme smuggling like 'unsafe-inline' or javascript:, so env vars can widen the allowlist but never weaken the policy.
• script-src 'self' <origins> with no unsafe-inline, no unsafe-eval, no nonces. Made viable by externalizing both index.html inline bootstraps into public/theme-init.js (sync, pre-paint dark mode preserved) and public/analytics-init.js (deferred GA4 + Clarity, still hostname-gated to production).
• connect-src includes a ws(s)://<host> source derived from server.publicUrl for the live-update WebSocket; analytics/Sentry ingest origins come from the allowlist.
• img-src 'self' data: blob: <avatar/GA hosts> — uploads/previews keep working; arbitrary remote images in chat markdown are now intentionally blocked (the one deliberate behavior change; documented in the QA case).
• Kill switch: FIRST_TREE_SECURITY_HEADERS_ENABLED=false removes the whole layer (logged warning).

Config surface

New security group in shared server config, documented in docs/cli-reference.md:

• FIRST_TREE_SECURITY_HEADERS_ENABLED (default true)
• FIRST_TREE_CSP_SCRIPT_ORIGINS / FIRST_TREE_CSP_CONNECT_ORIGINS / FIRST_TREE_CSP_IMG_ORIGINS — comma/whitespace-separated origin lists that replace the defaults (defaults = current production dependencies: GA4, Clarity, Sentry ingest, GitHub/Google avatar hosts).

Tests

• packages/server/src/__tests__/security-headers.test.ts — unit tests pin the exact header set and every CSP directive (incl. never-unsafe-inline/eval and publicUrl → ws derivation); integration tests via buildApp prove all five reply shapes carry the full set and that the kill switch removes it.
• packages/shared/src/config/__tests__/server-config.test.ts — defaults, env list parsing (trim/lowercase/replace semantics), and rejection of non-origin sources.
• packages/web/src/__tests__/csp.test.ts — regression net: index.html must contain zero inline scripts, referenced bootstraps must exist in public/, and every third-party loader origin in analytics-init.js must be in the default script-src allowlist.
• packages/web/src/__tests__/analytics.test.ts — updated to assert against the externalized analytics-init.js.

Verification

• pnpm check PASS, pnpm typecheck PASS (all 10 tasks)
• Server suite: 245 files / 2654 tests PASS (full run against local PostgreSQL via the suite's CI_DATABASE_URL path)
• Shared suite: 700/700 PASS; web: targeted CSP/analytics tests PASS (4 unrelated timezone-sensitive failures reproduce identically on clean main)

QA

Added packages/qa/cases/cross-surface/web-security-headers-csp.md — a formal QA pass with a live browser under the enforced policy is recommended before release (devtools-console CSP-violation watch during an authenticated pass; product tests can't see that layer).