feat(v3.16.0): security headers + Pages-demo retire + audit doc

[vnykmshr]

Summary

• Security middleware adds CSP (enforcing, SHA-256 hash for the FOUC inline script), HSTS (max-age=31536000; includeSubDomains, no preload), Permissions-Policy (9-feature deny incl. FLoC opt-out), and a CSP_DISABLE env var for operators behind edge proxies. Drops deprecated X-XSS-Protection.
• README points "Live install" at https://log.1mb.dev — the current 1mb-dev.github.io/markgo Pages serve is 96-day-stale wrong-account content and is retired via operator action below.
• docs/audit-2026-05-frontend.md catalogs 11 deferred frontend findings for v3.17.0+ scoping; each gets a GitHub issue with the audit-finding label post-merge.

Changes

• internal/middleware/middleware.go — Security() accepts *config.Config to read Security.CSPDisable. Hash + policy constants documented inline.
• internal/config/config.go — SecurityConfig.CSPDisable loaded via getEnvBool("CSP_DISABLE", false).
• internal/middleware/middleware_test.go — TestSecurity updated to assert new headers + X-XSS-Protection absent. TestSecurity_FOUCScriptHashMatches reads web.Assets and asserts the hardcoded hash matches base.html's inline script content. TestSecurity_ExactlyOneInlineJavaScript walks templates and asserts no new inline <script> slips in without a hash (JSON-LD excluded — non-JS MIME). TestSecurity_CSPDisableSkipsCSPHeader covers the toggle.
• .env.example, docs/configuration.md document CSP_DISABLE and the full security-header set.
• README.md, docs/audit-2026-05-frontend.md, CHANGELOG.md carry the demo-retire pointer + audit index + release notes.

Test plan

• make lint (post golangci-lint cache clean) — 0 issues
• make test-race — green
• curl -sI http://localhost:3000/ — emits CSP/HSTS/Permissions-Policy/X-Content-Type-Options/X-Frame-Options/Referrer-Policy; X-XSS-Protection absent
• CSP_DISABLE=true ./build/markgo serve — CSP absent, other 5 headers present
• Browser DevTools console on /, /writing, /writing/<slug>, /about, /p, /search, /compose — no CSP violations
• Service worker offline-queue: queue a compose draft, go offline, reload, return online — POST replays without CSP block

Operator actions (post-merge, manual)

• gh api repos/1mb-dev/markgo/pages --method DELETE (or disable Pages in repo settings) — retires the stale demo
• gh api repos/1mb-dev/markgo --method PATCH -f homepage=https://log.1mb.dev — keeps the sidebar link valid after Pages disable
• File 11 audit-finding issues from docs/audit-2026-05-frontend.md and backfill the Issue column

[vnykmshr]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

🤖 Generated with Claude Code