fix(security): audit batch B — SPA CSP/security headers + vite upgrade

Implements AUDIT_REPORT.md M-2 and M-5: - M-2: CSP (script-src 'self'; frame-ancestors 'none'; object-src 'none'; ...), nosniff, X-Frame-Options DENY, Referrer-Policy on the SPA nginx, plus gzip for the bundle. The inline theme bootstrap moved to /theme-init.js so script-src 'self' holds with no inline scripts. - M-5: vite 5 -> 8 (+ plugin-react 6) — clears the dev-only esbuild advisories; npm audit now reports 0 vulnerabilities including dev deps. Build verified. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-07-02 03:21:35 +02:00
parent 2056548702
commit 38a58871ac
5 changed files with 561 additions and 1125 deletions
@@ -5,16 +5,8 @@
    <link rel="icon" type="image/svg+xml" href="/favicon.svg" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>InboxIntel — Gmail analytics & cleanup</title>
-    <script>
-      // Apply the saved theme before first paint to avoid a flash of the wrong mode.
-      (function () {
-        try {
-          // Dark-first: default new users to dark unless they've chosen light.
-          var t = localStorage.getItem('ii:theme') || 'dark';
-          if (t === 'dark') document.documentElement.classList.add('dark');
-        } catch (e) {}
-      })();
-    </script>
+    <!-- Theme applied before first paint; external file so CSP can use script-src 'self'. -->
+    <script src="/theme-init.js"></script>
  </head>
  <body>
    <div id="root"></div>