fix(api-docs): serve Redoc from self rather than CDN to avoid CSP issues

Downloading redoc.standalone.js at build time (CI) and local dev
(proto:generate) so it is served from 'self', which the existing
Flutter CSP already allows. Removes the /api-docs/* CSP override
that was added to permit cdn.jsdelivr.net.

https://claude.ai/code/session_015uTnGiC56cEELZMH2cQQU4

Author: claude

.github/workflows/ci.yml

@@ -200,6 +200,7 @@ jobs:
           setup_only: true
       - run: cd proto && buf generate
       - run: cp docs/code/api/openapi/openapi.yaml web/api-docs/openapi.yaml
+      - run: curl -sLo web/api-docs/redoc.standalone.js https://cdn.jsdelivr.net/npm/redoc@2.4.0/bundles/redoc.standalone.js
 
       - name: Get git version info
         id: git_version

mise.dev.toml

@@ -46,6 +46,7 @@ dir = "proto"
 run = """
 buf generate
 cp ../docs/code/api/openapi/openapi.yaml ../web/api-docs/openapi.yaml
+curl -sLo ../web/api-docs/redoc.standalone.js https://cdn.jsdelivr.net/npm/redoc@2.4.0/bundles/redoc.standalone.js
 """
 
 [tasks."proto:clients"]

web/_headers

@@ -16,15 +16,6 @@
   Referrer-Policy: strict-origin-when-cross-origin
   Strict-Transport-Security: max-age=31536000; includeSubDomains
 
-# API docs — relaxed CSP to allow Redoc from jsDelivr CDN.
-# This path serves developer documentation, not the Flutter app.
-/api-docs/*
-  Content-Security-Policy: default-src 'self'; base-uri 'self'; frame-ancestors 'none'; object-src 'none'; script-src 'self' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data: https:; connect-src 'self'; worker-src 'self' blob:;
-  X-Content-Type-Options: nosniff
-  X-Frame-Options: DENY
-  Referrer-Policy: strict-origin-when-cross-origin
-  Strict-Transport-Security: max-age=31536000; includeSubDomains
-
 # Production Environment - Explicit domain rule for clarity
 # Custom domain: cambeerfestival.app
 # Path-based rules below apply to this domain for performance optimization

web/api-docs/.gitignore

@@ -1,2 +1,3 @@
 # Generated in CI (build-web job) and locally via: MISE_ENV=dev ./bin/mise run proto:generate
 openapi.yaml
+redoc.standalone.js

web/api-docs/index.html

@@ -18,6 +18,6 @@
       expand-responses="200"
       required-props-first="true"
     ></redoc>
-    <script src="https://cdn.jsdelivr.net/npm/redoc@2.4.0/bundles/redoc.standalone.js"></script>
+    <script src="redoc.standalone.js"></script>
   </body>
 </html>