Infra security fixes: Caddy log redaction, headers and non-root container; dev mounts only the FCM key; deploy records image digests (D-117)

- Caddyfile: access and error logs replace the /i/<code> segment and every query string with REDACTED
  (regexp filter on request>uri); Authorization stays redacted by default. Deferred response headers:
  Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy.
- Pi compose: caddy as uid 10002 with group 1000, read-only root, cap_drop ALL plus NET_BIND_SERVICE
  (needed to exec the image's file-capability binary), tmpfs /config and /tmp; install.sh sets /certs
  0750 1000:1000 and Caddy's /data to 10002.
- deploy.sh and install.sh print the pulled image digests and append them to /opt/kvitt/deployed-digests,
  warning when a recorded tag changed digest; the workflow prints the pushed digests; kvitt_cicd needs
  only write:package.
- Dev stack: up.sh stages only fcm-service-account.json into infra/dev/secrets/ (git-ignored), mounted
  read-only at /secrets.
- README: restricted cert-sync key required (plain root key not acceptable), remote_ip and log checks,
  APK download note, owner decisions (backup encryption, APK limit, key form, token scope), overhaul lines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/pi/deploy.sh

@@ -4,7 +4,8 @@
 #     migration and the Pi cannot tell beforehand (the rule "backup before a deploy with a migration" is applied
 #     to every deploy); skipped when no database exists yet, or with --skip-backup (rollback while Drive is down)
 #  2. sets KVITT_TAG in /opt/kvitt/.env (the previous tag is kept in /opt/kvitt/previous-tag)
-#  3. docker compose pull && docker compose up -d, waits for server to be healthy, prints GET /health
+#  3. docker compose pull, prints the pulled image digests and appends them to /opt/kvitt/deployed-digests (D-117),
+#     docker compose up -d, waits for server to be healthy, prints GET /health
 # Rollback after a failed migration: /opt/kvitt/deploy.sh "$(cat /opt/kvitt/previous-tag)"; if a migration had
 # partially applied, restore the pre-deploy backup (infra/RESTORE.md).
 set -euo pipefail
@@ -17,7 +18,7 @@ tag=""
 for arg in "$@"; do
   case "$arg" in
     --skip-backup) skip_backup=1 ;;
-    -h|--help) sed -n '2,10p' "$0"; exit 0 ;;
+    -h|--help) sed -n '2,11p' "$0"; exit 0 ;;
     -*) die "unknown option $arg" ;;
     *) [[ -z "$tag" ]] || die "usage: $0 <tag> [--skip-backup]"; tag=$arg ;;
   esac
@@ -47,6 +48,7 @@ if ! compose pull; then
   [[ -n "$current" ]] && env_set KVITT_TAG "$current"
   die "pull of $tag failed; KVITT_TAG left at ${current:-its old value}"
 fi
+record_digests "$tag"
 compose up -d --remove-orphans
 if ! wait_healthy server 180; then
   compose logs --tail 50 server || true