Infra security fixes: Caddy log redaction, headers and non-root container; dev mounts only the FCM key; deploy records image digests (D-117)

- Caddyfile: access and error logs replace the /i/<code> segment and every query string with REDACTED
  (regexp filter on request>uri); Authorization stays redacted by default. Deferred response headers:
  Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy.
- Pi compose: caddy as uid 10002 with group 1000, read-only root, cap_drop ALL plus NET_BIND_SERVICE
  (needed to exec the image's file-capability binary), tmpfs /config and /tmp; install.sh sets /certs
  0750 1000:1000 and Caddy's /data to 10002.
- deploy.sh and install.sh print the pulled image digests and append them to /opt/kvitt/deployed-digests,
  warning when a recorded tag changed digest; the workflow prints the pushed digests; kvitt_cicd needs
  only write:package.
- Dev stack: up.sh stages only fcm-service-account.json into infra/dev/secrets/ (git-ignored), mounted
  read-only at /secrets.
- README: restricted cert-sync key required (plain root key not acceptable), remote_ip and log checks,
  APK download note, owner decisions (backup encryption, APK limit, key form, token scope), overhaul lines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/dev/.gitignore

@@ -0,0 +1,2 @@
+# The FCM key staged by up.sh for the dev server (D-117); never committed.
+secrets/

infra/dev/compose.yaml

@@ -45,10 +45,11 @@ services:
     volumes:
       # SQLite database, pictures and APKs: a bind-mounted folder on the Mac (git-ignored).
       - ${KVITT_DEV_DATA_DIR:-./data}:/data
-      # The secrets folder, read-only, so the server finds /secrets/fcm-service-account.json (git-ignored).
-      # The folder is mounted rather than the file: a missing source file would make Docker create a directory
-      # in its place, while a missing key must simply leave push disabled with a start-up warning (§10.4).
-      - ${KVITT_SECRETS_DIR:-../secrets}:/secrets:ro
+      # Only the FCM key, read-only (D-117): up.sh copies ${KVITT_SECRETS_DIR}/fcm-service-account.json into
+      # infra/dev/secrets/ (git-ignored), which holds nothing else. A folder is mounted rather than the file, because
+      # a missing source file would make Docker create a directory in its place, while a missing key must simply
+      # leave push disabled with a start-up warning (§10.4); without the key the folder is empty.
+      - ./secrets:/secrets:ro
     healthcheck:
       test: ["CMD", "kvitt-server", "healthcheck"]
       interval: 30s

infra/dev/lib.sh

@@ -35,3 +35,19 @@ lan_address() {
   iface="$(route -n get default 2>/dev/null | awk '/interface:/ {print $2}')"
   [[ -n "$iface" ]] && ipconfig getifaddr "$iface" 2>/dev/null
 }
+
+# Fill infra/dev/secrets/ (git-ignored, mounted read-only at /secrets) with only the FCM key from
+# KVITT_SECRETS_DIR, so the server container sees no other secret (D-117). Without the key the folder is left
+# empty and the server starts with push disabled (§10.4).
+stage_fcm_key() {
+  local src stage="$dev_dir/secrets"
+  src="$(dev_path "$(env_value KVITT_SECRETS_DIR ../secrets)")/fcm-service-account.json"
+  install -d -m 0700 "$stage"
+  find "$stage" -mindepth 1 -maxdepth 1 ! -name fcm-service-account.json -exec rm -rf {} +
+  if [[ -f "$src" ]]; then
+    install -m 0600 "$src" "$stage/fcm-service-account.json"
+  else
+    rm -f "$stage/fcm-service-account.json"
+    echo "$(basename "$0"): no $src; the server starts with push disabled." >&2
+  fi
+}

infra/dev/up.sh

@@ -21,11 +21,8 @@ fi
 export KVITT_PUBLIC_URL="$public_url"
 
 data_dir="$(dev_path "$(env_value KVITT_DEV_DATA_DIR ./data)")"
-secrets_dir="$(dev_path "$(env_value KVITT_SECRETS_DIR ../secrets)")"
 mkdir -p "$data_dir"
-if [[ ! -f "$secrets_dir/fcm-service-account.json" ]]; then
-  echo "up.sh: no $secrets_dir/fcm-service-account.json; the server starts with push disabled." >&2
-fi
+stage_fcm_key
 
 compose up -d server