feat(security): enforce the Content Security Policy

The report-only run showed no violation in production.

src/csp.test.js

@@ -4,7 +4,7 @@ import {describe, expect, it} from 'vitest';
 
 const root = path.resolve(import.meta.dirname, '..');
 const nginx = readFileSync(path.join(root, 'nginx.conf'), 'utf8');
-const policy = nginx.match(/Content-Security-Policy(?:-Report-Only)? "([^"]+)"/)[1];
+const policy = nginx.match(/Content-Security-Policy "([^"]+)"/)[1];
 const directive = (name) => policy.split(';').map((part) => part.trim()).find((part) => part.startsWith(`${name} `));
 
 const LINK_ONLY_HOSTS = ['store.steampowered.com'];
@@ -34,6 +34,11 @@ describe('Content Security Policy in nginx.conf', () => {
         expect(directive('connect-src')).toBe("connect-src 'self' https://${AUTH_HOST} https://${API_HOST}");
     });
 
+    it('is enforced, not only reported', () => {
+        expect(nginx).toMatch(/add_header Content-Security-Policy "/);
+        expect(nginx).not.toContain('Content-Security-Policy-Report-Only');
+    });
+
     it('allows no inline or foreign script', () => {
         expect(directive('script-src')).toBe("script-src 'self'");
         expect(directive('frame-ancestors')).toBe("frame-ancestors 'none'");