feat: add time parameter type and HTTP security headers

[knep]

Summary

• New time parameter type — shows a native time picker in the UI; the script receives the time in a configurable Python strftime format (default %H:%M).
• HTTP security headers — every response now includes X-Content-Type-Options, Referrer-Policy, and a Content-Security-Policy header alongside the existing X-Frame-Options: DENY.

Changes

time parameter type

Backend (src/model/parameter_config.py)

• New time_format config field (default %H:%M, 24-hour clock).
• Validation in validate_value(): parses the browser wire format (HH:MM), rejects seconds, invalid hours, non-time strings.
• Format conversion in map_to_script(): parses %H:%M and re-formats to time_format before passing to the script.

Configuration example:

{
  "name": "start_time",
  "type": "time",
  "time_format": "%H:%M"
}

time_format is a Python strftime format string. Examples: %H:%M (default), %H%M, %I:%M %p.

Frontend

• New web-src/src/common/components/inputs/TimeField.vue — <input type="time"> with required/error handling, mirrors DateField.vue.
• script-parameters-view.vue routes type === 'time' to TimeField.
• Admin form (ParameterConfigForm.vue + parameter-fields.js) adds time to the type dropdown and shows a Time format field when selected.

Tests (src/tests/parameter_config_test.py) — 10 new assertions:

• Validation: valid, midnight, 23:59, wrong format (with seconds), non-time string, out-of-range hour (25:00).
• Map: default format passthrough, compact %H%M, with-seconds %H:%M:%S.

---

HTTP security headers (src/web/server.py)

Added a shared _set_security_headers() helper called by both BaseRequestHandler and BaseStaticHandler:

Header	Value
X-Frame-Options	DENY (was already present, now centralised)
X-Content-Type-Options	nosniff
Referrer-Policy	strict-origin-when-cross-origin
Content-Security-Policy	default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' ws: wss:; frame-ancestors 'none'; object-src 'none'

CSP rationale:

• style-src 'unsafe-inline' — Materialize CSS injects inline styles.
• connect-src ws: wss: — WebSocket used for live script output streaming.
• frame-ancestors 'none' — equivalent to X-Frame-Options: DENY for modern browsers.
• object-src 'none' — blocks Flash/plugin embeds.

Test plan

• src/tests/parameter_config_test.py — 188 tests pass (10 new time tests included)
• Full Python suite — 1638 passed, 2 pre-existing failures (htpasswd.crypt removed in Python 3.13+, unrelated)
• Frontend — 651 tests pass, webpack build clean

🤖 Generated with Claude Code