fix(web): add CSP meta tag to index.html (#175)

[intendednull]

What

Add <meta http-equiv="Content-Security-Policy"> tag to crates/web/index.html. Tighten the document head against script injection + clickjacking. Includes a static_assets test that pins the required directives so any future drift trips a test.

Why

crates/web/index.html ship with no CSP. Issue #175. Any reflected-script bug currently has full DOM authority.

Directives

default-src 'self';
script-src 'self' 'wasm-unsafe-eval' 'unsafe-eval';
style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
font-src 'self' https://fonts.gstatic.com;
connect-src 'self' ws: wss: https:;
img-src 'self' data: blob:;
media-src 'self' blob:;
worker-src 'self';
object-src 'none';
base-uri 'self';
form-action 'self';
frame-ancestors 'none'

Verified each directive against the actual app:

• 'wasm-unsafe-eval' — Leptos WASM module needs it.
• 'unsafe-eval' — NOT in the issue body, but the codebase still has live js_sys::eval() call sites in crates/web/src/app.rs (theme bootstrap, focus helpers, relay-URL probe) and crates/web/src/main.rs (service-worker register). Removing them is the scope of [security] XSS-prone js_sys::eval() in pinned message jump #171 / WS-1 ([WS-1] Web: js_sys::eval(format!()) for pinned-message scroll uses band-aid sanitization #425). Dropping 'unsafe-eval' here would regress those code paths today, so I kept it and documented the link to [security] XSS-prone js_sys::eval() in pinned message jump #171 inline. Drop it once eval is gone.
• 'unsafe-inline' for styles — Leptos views render lots of inline style="…" attrs (member list, message colors, settings tabs, profile popovers, …). Tightening to nonces is a separate refactor.
• Google Fonts hosts — crates/web/foundation.css line 15 @import url('https://fonts.googleapis.com/css2?…'). Fonts themselves come from fonts.gstatic.com.
• connect-src ws: wss: https: — relay WebSocket transport (ws://localhost:9091 dev / wss://willow.intendednull.com:9443 prod) + the /bootstrap-id HTTP probe in bootstrap_id_url().
• img-src data: — base64 avatar data URIs in message.rs:784.
• blob: (img + media + default fallback) — web_sys::Url::create_object_url_with_blob for file-attachment downloads (message.rs:78) and the chime audio in audio.rs.
• worker-src 'self' — service-worker registration via navigator.serviceWorker.register('/sw.js') in main.rs.
• frame-ancestors 'none' / object-src 'none' / base-uri 'self' / form-action 'self' — straight clickjacking + injection lockdown.

Tradeoffs

• 'unsafe-eval' kept. Issue body asked for it to be excluded. Excluding it today breaks the app because js_sys::eval() is still in use — locking down the policy must not regress functionality. Inline comment + commit body link this to [security] XSS-prone js_sys::eval() in pinned message jump #171 / [WS-1] Web: js_sys::eval(format!()) for pinned-message scroll uses band-aid sanitization #425 so the followup is obvious.
• 'unsafe-inline' kept for styles. Issue suggested tightening with nonces later. Trunk doesn't currently emit nonces, and Leptos inline styles are pervasive — out of scope here.
• Google Fonts allow-listed. Could be removed by self-hosting the font files; that's a separate change. Keeping the network request unblocked here.

Verification

• cargo fmt --check — clean.
• cargo clippy --workspace --all-targets -- -D warnings — clean.
• cargo test --workspace — all green; new index_html_declares_content_security_policy test passes alongside the rest of crates/web/tests/static_assets.rs.
• cargo check --target wasm32-unknown-unknown -p willow-identity -p willow-state -p willow-messaging -p willow-crypto -p willow-transport -p willow-common -p willow-network -p willow-client -p willow-web — clean.
• Live just dev + agent-browser smoke not run — sandboxed env had no just binary and toolchain reinstall was already needed; the static-asset test pins the meta tag survives trunk build (it reads from crates/web/index.html which trunk passes through verbatim).

Refs #175

---

Generated by Claude Code