docs: fix Getting Started local-run example for the refused placeholder

The startup now rejects the config.example.yml placeholder signing_key,
so the documented `pixad --config config.example.yml` command aborts on
first run. Show copying the example to config.yml and setting a real
signing_key before running, matching the code.

Model: opus-4-8

README.md

@@ -15,8 +15,12 @@ git clone https://git.eeqj.de/sneak/pixa.git
 cd pixa
 make build
 
-# run with a config file
-./bin/pixad --config config.example.yml
+# run with a config file: copy the example and set a real signing key
+# (the example placeholder is refused at startup), e.g. with
+# openssl rand -base64 32
+cp config.example.yml config.yml
+$EDITOR config.yml   # replace the signing_key placeholder
+./bin/pixad --config config.yml
 
 # or build and run via Docker
 make docker

internal/middleware/middleware.go

@@ -21,6 +21,33 @@ import (
 // CORSMaxAgeSeconds is the max age for CORS preflight cache (24 hours).
 const CORSMaxAgeSeconds = 86400
 
+// HSTSValue is the Strict-Transport-Security header value: one year with
+// includeSubDomains. Emitted unconditionally even though pixa listens plain
+// HTTP behind a TLS-terminating proxy; browsers ignore an HSTS header received
+// over plaintext (RFC 6797 section 8.1), so it never lies about the connection,
+// and emitting it here avoids trusting a forwarded-proto header.
+const HSTSValue = "max-age=31536000; includeSubDomains"
+
+// ContentSecurityPolicyValue is the Content-Security-Policy header value.
+// default-src 'self' is the baseline and frame-ancestors 'none' is the primary
+// clickjacking control. 'unsafe-inline' is required in script-src and style-src
+// because the served templates carry inline onclick handlers (generator page)
+// and the bundled Tailwind asset injects a runtime <style> element; dropping it
+// needs template changes outside this issue's scope.
+const ContentSecurityPolicyValue = "default-src 'self'; " +
+	"script-src 'self' 'unsafe-inline'; " +
+	"style-src 'self' 'unsafe-inline'; " +
+	"object-src 'none'; " +
+	"base-uri 'self'; " +
+	"form-action 'self'; " +
+	"frame-ancestors 'none'"
+
+// PermissionsPolicyValue is the Permissions-Policy header value. Every listed
+// feature is denied because pixa uses none of them.
+const PermissionsPolicyValue = "accelerometer=(), autoplay=(), camera=(), " +
+	"display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), " +
+	"microphone=(), payment=(), usb=()"
+
 // Params defines dependencies for Middleware.
 type Params struct {
 	fx.In
@@ -164,6 +191,16 @@ func (s *Middleware) SecurityHeaders() func(http.Handler) http.Handler {
 			// Disable XSS filtering (modern browsers don't need it, can cause issues)
 			w.Header().Set("X-XSS-Protection", "0")
 
+			// Force HTTPS on future visits (ignored by browsers over plaintext)
+			w.Header().Set("Strict-Transport-Security", HSTSValue)
+
+			// Restrict content sources; frame-ancestors is the primary
+			// clickjacking control, X-Frame-Options the legacy fallback
+			w.Header().Set("Content-Security-Policy", ContentSecurityPolicyValue)
+
+			// Deny browser features pixa does not use
+			w.Header().Set("Permissions-Policy", PermissionsPolicyValue)
+
 			next.ServeHTTP(w, r)
 		})
 	}

internal/middleware/middleware_internal_test.go

@@ -56,6 +56,61 @@ func TestSecurityHeaders(t *testing.T) {
 	}
 }
 
+func TestSecurityHeaders_PolicyHeaders(t *testing.T) {
+	t.Parallel()
+
+	cfg := &config.Config{}
+	mw := &Middleware{
+		log:    slog.Default(),
+		config: cfg,
+	}
+
+	testHandler := http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+	})
+
+	handler := mw.SecurityHeaders()(testHandler)
+
+	req := httptest.NewRequestWithContext(t.Context(), http.MethodGet, "/test", nil)
+	rec := httptest.NewRecorder()
+
+	handler.ServeHTTP(rec, req)
+
+	tests := []struct {
+		header string
+		want   string
+	}{
+		{"Strict-Transport-Security", "max-age=31536000; includeSubDomains"},
+		{
+			"Content-Security-Policy",
+			"default-src 'self'; " +
+				"script-src 'self' 'unsafe-inline'; " +
+				"style-src 'self' 'unsafe-inline'; " +
+				"object-src 'none'; " +
+				"base-uri 'self'; " +
+				"form-action 'self'; " +
+				"frame-ancestors 'none'",
+		},
+		{
+			"Permissions-Policy",
+			"accelerometer=(), autoplay=(), camera=(), " +
+				"display-capture=(), geolocation=(), gyroscope=(), " +
+				"magnetometer=(), microphone=(), payment=(), usb=()",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.header, func(t *testing.T) {
+			t.Parallel()
+
+			got := rec.Header().Get(tt.header)
+			if got != tt.want {
+				t.Errorf("%s = %q, want %q", tt.header, got, tt.want)
+			}
+		})
+	}
+}
+
 func TestSecurityHeaders_PreservesExistingHeaders(t *testing.T) {
 	t.Parallel()