Infra security fixes: Caddy log redaction, headers and non-root container; dev mounts only the FCM key; deploy records image digests (D-117)

- Caddyfile: access and error logs replace the /i/<code> segment and every query string with REDACTED
  (regexp filter on request>uri); Authorization stays redacted by default. Deferred response headers:
  Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy.
- Pi compose: caddy as uid 10002 with group 1000, read-only root, cap_drop ALL plus NET_BIND_SERVICE
  (needed to exec the image's file-capability binary), tmpfs /config and /tmp; install.sh sets /certs
  0750 1000:1000 and Caddy's /data to 10002.
- deploy.sh and install.sh print the pulled image digests and append them to /opt/kvitt/deployed-digests,
  warning when a recorded tag changed digest; the workflow prints the pushed digests; kvitt_cicd needs
  only write:package.
- Dev stack: up.sh stages only fcm-service-account.json into infra/dev/secrets/ (git-ignored), mounted
  read-only at /secrets.
- README: restricted cert-sync key required (plain root key not acceptable), remote_ip and log checks,
  APK download note, owner decisions (backup encryption, APK limit, key form, token scope), overhaul lines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/pi/Caddyfile

@@ -1,6 +1,15 @@
+# Kvitt Caddyfile (SPEC §10.5.2, D-117). Installed as /opt/kvitt/Caddyfile; cert-sync reloads it through the admin API.
 {
 	admin 0.0.0.0:2019
 	auto_https off
+	# Caddy's own error log (for example a 502 when the server is down) carries the request too: same URI filter.
+	log default {
+		output stderr
+		format filter {
+			request>uri regexp `^(/i/)[^?]+|([?]).+` `${1}${2}REDACTED`
+			wrap json
+		}
+	}
 }
 
 icehack.asuscomm.com:8443 {
@@ -8,9 +17,22 @@ icehack.asuscomm.com:8443 {
 	request_body {
 		max_size 6MB
 	}
+	# Set after the server's response headers (defer), so a header the server also sends appears once.
+	header {
+		defer
+		Content-Security-Policy "default-src 'none'; style-src 'unsafe-inline'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'"
+		X-Content-Type-Options nosniff
+		X-Frame-Options DENY
+		Referrer-Policy no-referrer
+	}
 	reverse_proxy server:8080
+	# Access log: the invite code in /i/<code> and every query string (the inviter's name in ?from=) become
+	# REDACTED (SPEC §8.7); the Authorization header is redacted by Caddy's default.
 	log {
 		output stdout
-		format json
+		format filter {
+			request>uri regexp `^(/i/)[^?]+|([?]).+` `${1}${2}REDACTED`
+			wrap json
+		}
 	}
 }