Security, stability, and performance quick wins

[Sparksx]

Summary

Comprehensive codebase audit across security, stability, performance, and functionality — implementing the highest-priority quick wins (13 fixes across 12 files).

Security

• Enable CSP — contentSecurityPolicy: false → proper directive set (scripts, styles, connect, frames)
• Ban check on HTTP routes — bans previously only blocked socket connections; now all requireAuth routes reject banned users
• Separate JWT dev secrets — access and refresh tokens shared the same default secret in dev mode
• PvP rate limiting — 3 fights per 10 seconds to prevent Elo manipulation via scripted requests
• Settings key whitelist — PUT /api/auth/settings now rejects unknown keys instead of blindly merging
• Server-side clan creation cost — CLAN_CREATE_COST (500g) moved to shared/ and enforced in a transaction; previously only checked client-side

Stability

• Atomic clan leave — ownership transfer + member deletion wrapped in a single transaction (was a TOCTOU race)
• Atomic refund clawback — payment webhook's gold deduction now runs inside one transaction (was a read-then-write race)
• Remove duplicate shutdown handler — prisma.js had its own SIGTERM/SIGINT handlers that raced with server/index.js
• Socket error boundaries — chat:share-combat and chat:join handlers now have try/catch

Performance

• Lightweight clan listing — GET /api/clans now uses _count instead of loading full member game states (was fetching all equipment JSON for 25 clans × N members, unused in list view)
• Cache-Control on packs — GET /api/payment/packs returns static config data, now cached 1 hour

Frontend

• Reliable tab-close save — uses keepalive: true on the unload fetch so the browser completes the request after page teardown

Test plan

• All 524 existing tests pass
• Build succeeds (npm run build)
• Lint unchanged (53 warnings, 0 errors — no new issues)
• Verify clan creation deducts 500g (manual test)
• Verify banned user gets 403 on API routes (manual test)
• Verify PvP rate limit triggers after 3 rapid fights

---

Generated by Claude Code