clawbot d81da05748 nginx: security headers on every response (closes #18) ...

nginx sent none of the security headers REPO_POLICIES.md requires.
security-headers.conf now sets all six with always, included at server
level and again in /assets/, whose own add_header would otherwise drop
them. nginx hides the copies netwatch-server sets, so /api/ and the
health check carry each header once. The content security policy
allows no inline script or style; the host row's status dot took its
grey from a style attribute, now a class. connect-src is * because
several probed hosts redirect to other hosts and the browser checks
every redirect against it. Referrer-Policy is no-referrer, as the
backend already sends.

Model: opus-5-5

2026-09-29 10:22:12 +02:00

..

main.js

nginx: security headers on every response (closes #18)

2026-09-29 10:22:12 +02:00

styles.css

fix(frontend): meet the 44x44 minimum tap target on every control (closes #43)

2026-08-10 16:12:00 +02:00