Send a CSP and security headers from the frontend's nginx

script-src admits the bundle and the pre-paint theme script by hash, with no
unsafe-inline or unsafe-eval; style-src keeps unsafe-inline for the <style>
elements Monaco, Radix and the toasts insert. frame-ancestors 'self',
nosniff and strict-origin-when-cross-origin go with it, and the Dockerfile
adds the API origin to connect-src when the bundle calls one elsewhere. Zod
runs jitless so its eval probe is not reported on every page. The embed
widget keeps allow-same-origin: the demo's weather map does not render
without it; the comment now says so and what it costs.

frontend/src/components/Dashboard/widgets.tsx

@@ -474,8 +474,12 @@ function EmbedWidget({ widget }: WidgetProps) {
     <iframe
       src={url}
       title={widget.title || url}
-      // Same-origin is deliberately withheld: the page keeps its own storage
-      // and cookies only by being another origin, which it is.
+      // `allow-same-origin` keeps the page in its own origin, with the
+      // cookies and storage most sites will not start without: the demo's
+      // weather map renders an unstyled list without it. That is safe only
+      // while the page *is* another origin. One served from this app's own
+      // origin would run as the app, scripts and all, and could read the
+      // session.
       sandbox="allow-scripts allow-popups allow-forms allow-same-origin"
       referrerPolicy="no-referrer"
       loading="lazy"

frontend/src/lib/zodConfig.ts

@@ -0,0 +1,12 @@
+/**
+ * Zod without its `eval` probe.
+ *
+ * Zod compiles a faster object parser with `new Function` where it can, and
+ * finds out by trying once. Under the CSP (`frontend/nginx-security-headers.conf`)
+ * that try is reported as a violation on every page, although Zod catches it
+ * and falls back. `jitless` skips the probe and goes straight to the fallback.
+ * Imported first in `main.tsx`, since a schema built before it would probe.
+ */
+import { z } from "zod"
+
+z.config({ jitless: true })

frontend/src/main.tsx

@@ -1,3 +1,5 @@
+// First: it configures Zod before any module builds a schema.
+import "./lib/zodConfig"
 import {
   MutationCache,
   QueryCache,