Security hardening: CSRF, CSP, input validation, secrets management

[mondial7]

Broader security work beyond the focused issues #22–#27 and the rate-limiting tracked in #26.

Scope

• CSRF protection for state-changing API calls (double-submit cookie or SameSite + custom header).
• Content-Security-Policy headers (nginx for the docker stack, middleware for the single-binary).
• Input sanitization via go-playground/validator on every request body — currently ad-hoc in handlers.
• Production secrets management — document Docker secrets / Vault patterns; today .env files are it.

Out of scope

• Rate limiting → already Security: rate-limit auth + submission endpoints #26.
• The 6 access-control findings → already Security: stop delivering JWT via URL query parameter on OAuth callback #22–Security: first-user-becomes-admin race condition on empty DB #27.

Effort: medium (3–4 days).

[mondial7]

Partially addressed by #54: CSRF is now implemented (per-session signed token via X-CSRF-Token/hidden field on all unsafe methods; SSE stream guarded by a distinct session-derived token). Input is contextually escaped by html/template and validated server-side; secrets come from env. Still open: a Content-Security-Policy header and broader security-header middleware. Suggest narrowing this issue to CSP + security headers.

[mondial7]

Done in #57 (and earlier CSRF work). All named concerns are addressed:

• CSRF — per-session signed token on every unsafe request; the state-changing SSE GETs use a separate stream token.
• CSP — strict Content-Security-Policy (script-src 'self', no inline scripts) plus X-Frame-Options: DENY, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy on every response.
• Input validation — server-side validators (ratings, relationship/frequency, roles, required fields); html/template contextual escaping; UUIDs validated at the DB boundary; a PDF filename header-injection vector was fixed and redirects are same-origin-guarded.
• Secrets — env-based, SESSION_SECRET required in prod, .env gitignored, Gemini key scrubbed from logs.
  govulncheck and gosec run clean.