[SandObserver]

Summary

• docker-entrypoint.sh: wait with || status=$? and loop while supervisord is alive. Under set -eu the wait interrupted by the TERM trap returned 143 and exited PID 1, so the kernel killed supervisord, nginx and the API mid-shutdown (02-1).
• docker-compose.yml: add the KILL capability. Root supervisord cannot signal the API, which runs as node, without it; a stop logged unknown problem killing api ... Operation not permitted and the API died by SIGKILL.
• Dockerfile: copy api/ and the shared ui/js modules without --chown=node:node, so the API cannot rewrite its own code (02-5).
• exit-on-fatal.py, docker-entrypoint.sh, supervisord.conf: the fatal marker and supervisord's pid file move from /tmp to root-owned /run (02-6).
• nginx/csp-api.conf: default-src 'none'; frame-ancestors 'none'; sandbox, included by the three /api/ locations, which did not inherit the server policy (02-7).
• templates/stackyard.xml: ExtraParams with the Compose capabilities, no-new-privileges, --init, PID, memory and CPU limits (02-9), and the Compose NODE_OPTIONS heap cap so the memory limit does not kill the API.

Testing
All green, including the homelab Docker build and a throwaway container (clean stop exits 0, fatal path exits 1, /api/ CSP, root-owned /app). Added 5 entrypoint shutdown tests that run the real script (4 fail without the fix, under sh and dash) and tests for the /run paths, source ownership, the API policy, the template flags and the KILL capability.

Changelog

Fixed

• Stop the container cleanly on docker stop instead of killing the dashboard mid-shutdown.

Security

• Send a restrictive Content-Security-Policy on API responses.
• Apply the Compose file's capability, privilege and resource limits to the Unraid template.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.