Apply remaining changes

Author: Copilot

docs/tooling/cloudflare-pages.md

@@ -55,9 +55,10 @@ The app uses two Cloudflare Pages configuration files in the `web/` directory:
 
 **Security headers** (all environments):
 - `X-Content-Type-Options: nosniff`
-- `X-Frame-Options: SAMEORIGIN`
+- `X-Frame-Options: DENY`
 - `Referrer-Policy: strict-origin-when-cross-origin`
-- `Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; ...`
+- `Strict-Transport-Security: max-age=31536000; includeSubDomains`
+- `Content-Security-Policy` including Flutter-safe `script-src 'wasm-unsafe-eval'` and Firebase/data `connect-src` origins
 
 > **Note**: Both `_headers` and `_redirects` files are automatically included in the Flutter web build output (`build/web/`) and deployed with the app. These files are processed by Cloudflare Pages during deployment to configure the platform - **they won't appear in the list of uploaded assets** in the Cloudflare dashboard, but they are applied to the deployment. Domain-specific rules for staging are placed at the end of the `_headers` file to ensure they override path-based production rules.
 

web/_headers

@@ -1,6 +1,17 @@
 # Cloudflare Pages Headers Configuration
 # See: https://developers.cloudflare.com/pages/platform/headers/
 
+# Global security headers (all environments)
+/*
+  # CSP notes:
+  # - script-src keeps Flutter/CanvasKit working via 'wasm-unsafe-eval'
+  # - connect-src allows app API plus Firebase Analytics/Crashlytics endpoints
+  Content-Security-Policy: default-src 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'; script-src 'self' 'wasm-unsafe-eval' https://www.googletagmanager.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https://data.cambeerfestival.app https://www.google-analytics.com https://region1.google-analytics.com https://firebaseinstallations.googleapis.com https://firebaselogging-pa.googleapis.com; worker-src 'self' blob:;
+  X-Content-Type-Options: nosniff
+  X-Frame-Options: DENY
+  Referrer-Policy: strict-origin-when-cross-origin
+  Strict-Transport-Security: max-age=31536000; includeSubDomains
+
 # Production Environment - Explicit domain rule for clarity
 # Custom domain: cambeerfestival.app
 # Path-based rules below apply to this domain for performance optimization