fix(security): safe links and security headers (FLAW-28, FLAW-29)

safeHref lets only http, https and mailto become links (Markdown viewer,
outliner, legal links); javascript: and friends show as text. A
middleware sets a Content-Security-Policy (scripts only from MindSift,
no framing, connections only to this server), X-Frame-Options,
nosniff, Referrer-Policy and a Permissions-Policy. The two inline
scripts of index.html moved to files so script-src stays 'self'.

The second inline script also deleted every cache on each page load,
which undermined the offline start; it is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/headers.go

@@ -0,0 +1,48 @@
+package api
+
+import (
+	"net/http"
+	"strings"
+)
+
+// securityHeaders protects the browser side (FLAW-29):
+//   - Content-Security-Policy: scripts only from MindSift itself, so injected markup cannot run code;
+//     styles may be inline (custom themes, style attributes); images also from https (avatar URLs);
+//     connections only to this server, including its WebSocket.
+//   - frame-ancestors 'none' / X-Frame-Options: no embedding in other sites (clickjacking).
+//   - nosniff, a same-origin referrer and a permissions policy that only allows the microphone
+//     (speech input) for MindSift itself.
+func (s *Server) securityHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		h := w.Header()
+		h.Set("Content-Security-Policy", contentSecurityPolicy(r.Host))
+		h.Set("X-Frame-Options", "DENY")
+		h.Set("X-Content-Type-Options", "nosniff")
+		h.Set("Referrer-Policy", "same-origin")
+		h.Set("Permissions-Policy", "microphone=(self), camera=(), geolocation=(), payment=()")
+		next.ServeHTTP(w, r)
+	})
+}
+
+func contentSecurityPolicy(host string) string {
+	connect := "'self'"
+	// Older Safari versions do not count ws:/wss: as 'self'
+	if host != "" && !strings.ContainsAny(host, " ;'\"") {
+		connect += " wss://" + host + " ws://" + host
+	}
+	return strings.Join([]string{
+		"default-src 'self'",
+		"script-src 'self'",
+		"style-src 'self' 'unsafe-inline'",
+		"img-src 'self' data: blob: https:",
+		"font-src 'self' data:",
+		"connect-src " + connect,
+		"worker-src 'self'",
+		"manifest-src 'self'",
+		"media-src 'self' blob:",
+		"object-src 'none'",
+		"base-uri 'self'",
+		"form-action 'self'",
+		"frame-ancestors 'none'",
+	}, "; ")
+}

internal/api/headers_test.go

@@ -0,0 +1,34 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+func TestSecurityHeaders(t *testing.T) {
+	srv, _, _ := setupTestServer(t)
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/health", nil)
+	req.Host = "notes.example.com"
+	srv.Router().ServeHTTP(rec, req)
+	csp := rec.Header().Get("Content-Security-Policy")
+	for _, want := range []string{"script-src 'self'", "frame-ancestors 'none'", "object-src 'none'", "wss://notes.example.com"} {
+		if !strings.Contains(csp, want) {
+			t.Errorf("CSP lacks %q: %s", want, csp)
+		}
+	}
+	if strings.Contains(csp, "unsafe-eval") || strings.Contains(strings.Split(strings.Split(csp, "script-src")[1], ";")[0], "unsafe-inline") {
+		t.Errorf("scripts must not allow inline or eval: %s", csp)
+	}
+	for k, v := range map[string]string{"X-Frame-Options": "DENY", "X-Content-Type-Options": "nosniff", "Referrer-Policy": "same-origin"} {
+		if rec.Header().Get(k) != v {
+			t.Errorf("%s = %q, want %q", k, rec.Header().Get(k), v)
+		}
+	}
+	// A Host header with quotes or semicolons must not be able to extend the policy
+	if p := contentSecurityPolicy("evil.com; script-src *"); strings.Contains(p, "evil.com") {
+		t.Errorf("host must not be copied into the policy unchecked: %s", p)
+	}
+}

internal/api/server.go

@@ -83,6 +83,7 @@ func (s *Server) Router() http.Handler {
 	r := chi.NewRouter()
 
 	r.Use(s.clientIPMiddleware)
+	r.Use(s.securityHeaders)
 	r.Use(s.demoResetGate)
 	r.Use(middleware.Recoverer)
 	r.Use(s.apiLoggingMiddleware)