Add CSP header to all HTTP responses for defense-in-depth against XSS.
The policy restricts all resource loading to same-origin and disables
dangerous features (object embeds, framing, base tag injection). The
embedded SPA requires no inline scripts or inline style attributes
(Preact applies styles programmatically via DOM properties), so a
strict policy without 'unsafe-inline' works correctly.
Directives:
default-src 'self' — baseline same-origin restriction
script-src 'self' — same-origin scripts only
style-src 'self' — same-origin stylesheets only
connect-src 'self' — same-origin fetch/XHR only
img-src 'self' — same-origin images only
font-src 'self' — same-origin fonts only
object-src 'none' — no plugin content
frame-ancestors 'none' — prevent clickjacking
base-uri 'self' — prevent base tag injection
form-action 'self' — restrict form submissions
Migration 003 created tables with INTEGER keys referencing TEXT primary
keys from migration 002, causing 'no such column' errors. Fix by
properly dropping old tables before recreating with the integer schema.
Rewrite all tests to use the queries.go API (which matches the live
schema) instead of the model-based API (which expected the old UUID
schema).
CreateUser, GetUserByNick, GetUserByToken exist in both db.go (model-based,
used by tests) and queries.go (simple, used by handlers). Rename the
model-based variants to CreateUserModel, GetUserByNickModel, and
GetUserByTokenModel to resolve the compilation error.
clawbot