feat: add Content-Security-Policy header for embedded web SPA

Set CSP header on all SPA-served responses to provide defense-in-depth
against XSS. The policy restricts scripts, styles, and all other
resource types to same-origin only, matching the SPA's actual behavior
(external CSS/JS files, same-origin fetch API calls, no WebSockets or
external resources).

Dockerfile

@@ -15,7 +15,9 @@ WORKDIR /src
 COPY go.mod go.sum ./
 RUN go mod download
 COPY . .
-COPY --from=web-builder /web/dist/ web/dist/
+# Create placeholder files so //go:embed dist/* in web/embed.go resolves
+# without depending on the web-builder stage (lint should fail fast)
+RUN mkdir -p web/dist && touch web/dist/index.html web/dist/style.css web/dist/app.js
 RUN make fmt-check
 RUN make lint
 

README.md

@@ -1374,16 +1374,18 @@ Return server metadata. No authentication required.
 ```json
 {
   "name": "My NeoIRC Server",
+  "version": "0.1.0",
   "motd": "Welcome! Be nice.",
   "users": 42
 }
 ```
 
-| Field   | Type    | Description |
+| Field     | Type    | Description |
-|---------|---------|-------------|
+|-----------|---------|-------------|
-| `name`  | string  | Server display name |
+| `name`    | string  | Server display name |
-| `motd`  | string  | Message of the day |
+| `version` | string  | Server version |
-| `users` | integer | Number of currently active user sessions |
+| `motd`    | string  | Message of the day |
+| `users`   | integer | Number of currently active user sessions |
 
 ### GET /.well-known/healthcheck.json — Health Check
 
@@ -1850,26 +1852,16 @@ docker run -p 8080:8080 \
   neoirc
 ```
 
-The Dockerfile is a multi-stage build:
+The Dockerfile is a four-stage build:
-1. **Build stage**: Compiles `neoircd` and `neoirc-cli` (CLI built to verify
+1. **web-builder**: Installs Node dependencies and compiles the SPA (JSX →
+   bundled JS via esbuild) into `web/dist/`
+2. **lint**: Runs formatting checks and golangci-lint against the Go source
+   (uses empty placeholder files for `web/dist/` so it runs independently of
+   web-builder for fast feedback)
+3. **builder**: Runs tests and compiles static `neoircd` and `neoirc-cli`
+   binaries with the real SPA assets from web-builder (CLI built to verify
    compilation, not included in final image)
-2. **Final stage**: Alpine Linux + `neoircd` binary only
+4. **final**: Minimal Alpine image with only the `neoircd` binary
-
-```dockerfile
-FROM golang:1.24-alpine AS builder
-WORKDIR /src
-RUN apk add --no-cache make
-COPY go.mod go.sum ./
-RUN go mod download
-COPY . .
-RUN go build -o /neoircd ./cmd/neoircd/
-RUN go build -o /neoirc-cli ./cmd/neoirc-cli/
-
-FROM alpine:latest
-COPY --from=builder /neoircd /usr/local/bin/neoircd
-EXPOSE 8080
-CMD ["neoircd"]
-```
 
 ### Binary
 
@@ -2318,10 +2310,14 @@ neoirc/
 │       └── http.go         # HTTP timeouts
 ├── web/
 │   ├── embed.go            # go:embed directive for SPA
-│   └── dist/               # Built SPA (vanilla JS, no build step)
+│   ├── build.sh            # SPA build script (esbuild, runs in Docker)
-│       ├── index.html
+│   ├── package.json        # Node dependencies (preact, esbuild)
-│       ├── style.css
+│   ├── package-lock.json
-│       └── app.js
+│   ├── src/                # SPA source files (JSX + HTML + CSS)
+│   │   ├── app.jsx
+│   │   ├── index.html
+│   │   └── style.css
+│   └── dist/               # Generated at Docker build time (not committed)
 ├── schema/                 # JSON Schema definitions (planned)
 ├── go.mod
 ├── go.sum

internal/handlers/api.go

@@ -2392,9 +2392,10 @@ func (hdlr *Handlers) HandleServerInfo() http.HandlerFunc {
 		}
 
 		hdlr.respondJSON(writer, request, map[string]any{
-			"name":  hdlr.params.Config.ServerName,
+			"name":    hdlr.params.Config.ServerName,
-			"motd":  hdlr.params.Config.MOTD,
+			"version": hdlr.params.Globals.Version,
-			"users": users,
+			"motd":    hdlr.params.Config.MOTD,
+			"users":   users,
 		}, http.StatusOK)
 	}
 }

internal/server/routes.go

@@ -16,6 +16,11 @@ import (
 
 const routeTimeout = 60 * time.Second
 
+// cspHeader is the Content-Security-Policy applied to the embedded web SPA.
+// The SPA loads external scripts and stylesheets from the same origin only;
+// all API communication uses same-origin fetch (no WebSockets).
+const cspHeader = "default-src 'self'; script-src 'self'; style-src 'self'"
+
 // SetupRoutes configures the HTTP routes and middleware.
 func (srv *Server) SetupRoutes() {
 	srv.router = chi.NewRouter()
@@ -133,6 +138,11 @@ func (srv *Server) setupSPA() {
 		writer http.ResponseWriter,
 		request *http.Request,
 	) {
+		writer.Header().Set(
+			"Content-Security-Policy",
+			cspHeader,
+		)
+
 		readFS, ok := distFS.(fs.ReadFileFS)
 		if !ok {
 			fileServer.ServeHTTP(writer, request)