Harden for production: dependencies, headers, admin roles, docs

Dependencies
- The server build carried 37 known advisories, including RUSTSEC-2024-0363
  in sqlx 0.7, which is the database layer. sqlx moved to 0.8 with
  default-features off, which also drops the MySQL and SQLite drivers and
  with them rsa and RUSTSEC-2023-0071. reqwest moved to 0.12, which brings
  hyper 1.x and was the sole source of every remaining advisory: h2 0.3,
  rustls-webpki 0.101, rustls-pemfile 1.0 and idna 0.3.
- The server build now reports no known vulnerabilities against OSV. cargo
  audit itself would not compile, so the check queries OSV with the crate
  versions cargo tree reports for the server binary.
- Cargo.lock is committed. This workspace produces binaries, so the lockfile
  is what makes a deployed build reproducible and the audit above meaningful.

Headers
- The application sent no security headers at all. The static server now
  sends a Content-Security-Policy, nosniff, frame options, a referrer policy
  and a permissions policy; the API sends a policy of its own, since it
  serves JSON and should load and frame nothing.
- The one inline script in index.html moved to a file so script-src needs no
  unsafe-inline. WebAssembly needs wasm-unsafe-eval, without which nothing
  types at all, so that is present and explained.
- Five style attributes moved to the CSSOM rather than adding unsafe-inline
  for styles. A style attribute in markup is refused by the policy; the same
  property set through element.style is not.

Production configuration
- With TYPERPUNK_ENV=production the server refuses to start if COOKIE_SECURE
  is off, if DATABASE_URL is still the development default, or if
  FRONTEND_ORIGIN is http on a non-local host. These were warnings, and a
  warning in a log nobody reads is not a safeguard.

Administration
- Moderators were appointed with psql. There is now an admin role,
  bootstrapped from TYPERPUNK_ADMIN_USERNAME at startup, and a UI to appoint
  and remove moderators. An administrator's own role cannot be changed
  through the API, so a mistake cannot lock everyone out of moderation.

Corpus
- scripts/export_approved.js writes approved submissions back into
  data/packs/community-*.json. Approved passages are served from the database
  and merged at startup, so without this the repository dataset and the live
  corpus drift apart, and a fresh checkout or the TUI sees only what shipped.

Documentation
- README rewritten for the repository: what it does, how to run it, the pack
  format, the server variables, deployment, and what the security posture
  actually is. Plain English, no em dashes, no emoji.

Checked and found already correct: every private endpoint refuses anonymous
callers, session cookies are HttpOnly and SameSite=Lax, CORS names a single
origin, internal errors are logged rather than returned, and every query is
parameterised.

1 files changed, 40 insertions, 3 deletions

diff --git a/web/serve.mjs b/web/serve.mjs
index 64d6339..8f5644e 100644
--- a/web/serve.mjs
+++ b/web/serve.mjs
@@ -10,6 +10,43 @@ const ROOT = resolve(fileURLToPath(new URL('.', import.meta.url)));
 const PORT = Number(process.env.PORT) || 4173;
 const HOST = process.env.HOST || '0.0.0.0';
 
+// Sent with every response.
+//
+// The API origin is separate during development, so connect-src has to allow
+// it. In production the reverse proxy makes the API same-origin and
+// API_ORIGIN can be left unset, which drops the extra source.
+const API_ORIGIN = process.env.API_ORIGIN || (PORT === 4173 ? 'http://localhost:8787 ws://localhost:8787' : '');
+
+const SECURITY_HEADERS = {
+    // No inline script: index.html loads every script from a file so this can
+    // stay strict. Style needs Google Fonts' stylesheet, and the font files
+    // come from gstatic. The favicon is a data: URI.
+    'Content-Security-Policy': [
+        "default-src 'self'",
+        // wasm-unsafe-eval is required to instantiate WebAssembly. It permits
+        // WASM compilation only, not eval() or inline script, and the typing
+        // engine is a WASM module - without it nothing types at all.
+        "script-src 'self' 'wasm-unsafe-eval'",
+        "style-src 'self' https://fonts.googleapis.com",
+        "font-src 'self' https://fonts.gstatic.com",
+        "img-src 'self' data:",
+        `connect-src 'self'${API_ORIGIN ? ' ' + API_ORIGIN : ''}`,
+        "frame-ancestors 'none'",
+        "base-uri 'self'",
+        "form-action 'self'",
+        "object-src 'none'",
+    ].join('; '),
+    // Stops a browser second-guessing a declared Content-Type, which is how a
+    // served file gets treated as script.
+    'X-Content-Type-Options': 'nosniff',
+    // frame-ancestors covers this for modern browsers; the header is for the
+    // ones that do not implement it.
+    'X-Frame-Options': 'DENY',
+    'Referrer-Policy': 'strict-origin-when-cross-origin',
+    // Nothing here uses any of them.
+    'Permissions-Policy': 'geolocation=(), microphone=(), camera=(), payment=(), usb=()',
+};
+
 const MIME_TYPES = {
     '.html': 'text/html; charset=utf-8',
     '.js': 'text/javascript; charset=utf-8',
@@ -51,7 +88,7 @@ async function resolveFile(urlPath) {
 const server = createServer(async (req, res) => {
     const filePath = (await resolveFile(req.url)) || (await resolveFile('/index.html'));
     if (!filePath) {
-        res.writeHead(404, { 'Content-Type': 'text/plain' });
+        res.writeHead(404, { ...SECURITY_HEADERS, 'Content-Type': 'text/plain' });
         res.end('Not found');
         return;
     }
@@ -62,10 +99,10 @@ const server = createServer(async (req, res) => {
         // development - no cache headers at all left the browser free to
         // hold onto old JS/CSS indefinitely with no way to tell it changed,
         // which has already caused a real "why don't I see the fix" report.
-        res.writeHead(200, { 'Content-Type': type, 'Cache-Control': 'no-cache' });
+        res.writeHead(200, { ...SECURITY_HEADERS, 'Content-Type': type, 'Cache-Control': 'no-cache' });
         res.end(body);
     } catch (err) {
-        res.writeHead(500, { 'Content-Type': 'text/plain' });
+        res.writeHead(500, { ...SECURITY_HEADERS, 'Content-Type': 'text/plain' });
         res.end('Internal server error');
         console.error(err);
     }