Infra security fixes: Caddy log redaction, headers and non-root container; dev mounts only the FCM key; deploy records image digests (D-117)

- Caddyfile: access and error logs replace the /i/<code> segment and every query string with REDACTED
  (regexp filter on request>uri); Authorization stays redacted by default. Deferred response headers:
  Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy.
- Pi compose: caddy as uid 10002 with group 1000, read-only root, cap_drop ALL plus NET_BIND_SERVICE
  (needed to exec the image's file-capability binary), tmpfs /config and /tmp; install.sh sets /certs
  0750 1000:1000 and Caddy's /data to 10002.
- deploy.sh and install.sh print the pulled image digests and append them to /opt/kvitt/deployed-digests,
  warning when a recorded tag changed digest; the workflow prints the pushed digests; kvitt_cicd needs
  only write:package.
- Dev stack: up.sh stages only fcm-service-account.json into infra/dev/secrets/ (git-ignored), mounted
  read-only at /secrets.
- README: restricted cert-sync key required (plain root key not acceptable), remote_ip and log checks,
  APK download note, owner decisions (backup encryption, APK limit, key form, token scope), overhaul lines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

.gitea/workflows/build-images.yaml

@@ -6,8 +6,9 @@
 # plain HTTP), each tagged with the version vMAJOR.MINOR.PATCH and `latest`, then pushes the git tag of that version.
 # On the Kvitt Pi: /opt/kvitt/deploy.sh <version>.
 #
-# Secret: `kvitt_cicd`, a repository secret holding a Gitea access token (scopes write:package, and
-# write:repository for the tag push) of the user that pushes (owner step, infra/README.md).
+# Secret: `kvitt_cicd`, a repository secret holding a Gitea access token with scope write:package of the user that
+# pushes (owner step, infra/README.md). It is used only for `docker login`; the git tag push at the end goes through
+# the credentials actions/checkout stored (the job's own token), not this secret, so it needs no write:repository.
 #
 # RISK: the runner is a Raspberry Pi 3 with 1 GB RAM and the server image compiles about 232 Rust crates
 # (aws-lc-sys's C code included). The build passes CARGO_BUILD_JOBS=1 to keep memory down; server/Dockerfile
@@ -90,6 +91,7 @@ jobs:
             --provenance=false \
             -t "$REGISTRY/kvitt-cert-sync:$VERSION" \
             -t "$REGISTRY/kvitt-cert-sync:latest" \
+            --metadata-file /tmp/kvitt-cert-sync.metadata.json \
             ./infra/cert-sync \
             --push
       - name: Build backup image
@@ -99,6 +101,7 @@ jobs:
             --provenance=false \
             -t "$REGISTRY/kvitt-backup:$VERSION" \
             -t "$REGISTRY/kvitt-backup:latest" \
+            --metadata-file /tmp/kvitt-backup.metadata.json \
             ./infra/backup \
             --push
       - name: Build server image
@@ -111,8 +114,17 @@ jobs:
             -f ./server/Dockerfile \
             -t "$REGISTRY/kvitt-server:$VERSION" \
             -t "$REGISTRY/kvitt-server:latest" \
+            --metadata-file /tmp/kvitt-server.metadata.json \
             ./server \
             --push
+      - name: Print image digests
+        # The digests deploy.sh prints and records on the Kvitt Pi (/opt/kvitt/deployed-digests, D-117) must match.
+        run: |
+          for name in cert-sync backup server; do
+            digest=$(sed -n 's/.*"containerimage.digest": *"\([^"]*\)".*/\1/p' "/tmp/kvitt-$name.metadata.json")
+            echo "$REGISTRY/kvitt-$name:$VERSION ${digest:-unknown}"
+            rm -f "/tmp/kvitt-$name.metadata.json"
+          done
       - name: Tag and Push Version
         run: |
           git tag "$VERSION"