feat: add HSTS, CSP, and Permissions-Policy security headers (closes #91)

SecurityHeaders() now also sets Strict-Transport-Security,
Content-Security-Policy, and Permissions-Policy.

HSTS is emitted unconditionally: browsers ignore it over plaintext
(RFC 6797 section 8.1), so it never lies about the connection and no
forwarded-proto header need be trusted.

The CSP baseline is default-src 'self' with frame-ancestors 'none' as
the primary clickjacking control. script-src and style-src carry
'unsafe-inline' because the generator template has inline onclick
handlers and the bundled Tailwind asset injects a runtime <style>
element; removing that need is a template change beyond this issue.

Permissions-Policy denies browser features pixa does not use.

Model: opus-4-8

internal/middleware/middleware.go

@@ -21,6 +21,33 @@ import (
 // CORSMaxAgeSeconds is the max age for CORS preflight cache (24 hours).
 const CORSMaxAgeSeconds = 86400
 
+// HSTSValue is the Strict-Transport-Security header value: one year with
+// includeSubDomains. Emitted unconditionally even though pixa listens plain
+// HTTP behind a TLS-terminating proxy; browsers ignore an HSTS header received
+// over plaintext (RFC 6797 section 8.1), so it never lies about the connection,
+// and emitting it here avoids trusting a forwarded-proto header.
+const HSTSValue = "max-age=31536000; includeSubDomains"
+
+// ContentSecurityPolicyValue is the Content-Security-Policy header value.
+// default-src 'self' is the baseline and frame-ancestors 'none' is the primary
+// clickjacking control. 'unsafe-inline' is required in script-src and style-src
+// because the served templates carry inline onclick handlers (generator page)
+// and the bundled Tailwind asset injects a runtime <style> element; dropping it
+// needs template changes outside this issue's scope.
+const ContentSecurityPolicyValue = "default-src 'self'; " +
+	"script-src 'self' 'unsafe-inline'; " +
+	"style-src 'self' 'unsafe-inline'; " +
+	"object-src 'none'; " +
+	"base-uri 'self'; " +
+	"form-action 'self'; " +
+	"frame-ancestors 'none'"
+
+// PermissionsPolicyValue is the Permissions-Policy header value. Every listed
+// feature is denied because pixa uses none of them.
+const PermissionsPolicyValue = "accelerometer=(), autoplay=(), camera=(), " +
+	"display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), " +
+	"microphone=(), payment=(), usb=()"
+
 // Params defines dependencies for Middleware.
 type Params struct {
 	fx.In
@@ -164,6 +191,16 @@ func (s *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
 			// Disable XSS filtering (modern browsers don't need it, can cause issues)
 			w.Header().Set("X-XSS-Protection", "0")
 
+			// Force HTTPS on future visits (ignored by browsers over plaintext)
+			w.Header().Set("Strict-Transport-Security", HSTSValue)
+
+			// Restrict content sources; frame-ancestors is the primary
+			// clickjacking control, X-Frame-Options the legacy fallback
+			w.Header().Set("Content-Security-Policy", ContentSecurityPolicyValue)
+
+			// Deny browser features pixa does not use
+			w.Header().Set("Permissions-Policy", PermissionsPolicyValue)
+
 			next.ServeHTTP(w, r)
 		})
 	}