Infra security fixes: Caddy log redaction, headers and non-root container; dev mounts only the FCM key; deploy records image digests (D-117)

- Caddyfile: access and error logs replace the /i/<code> segment and every query string with REDACTED
  (regexp filter on request>uri); Authorization stays redacted by default. Deferred response headers:
  Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy.
- Pi compose: caddy as uid 10002 with group 1000, read-only root, cap_drop ALL plus NET_BIND_SERVICE
  (needed to exec the image's file-capability binary), tmpfs /config and /tmp; install.sh sets /certs
  0750 1000:1000 and Caddy's /data to 10002.
- deploy.sh and install.sh print the pulled image digests and append them to /opt/kvitt/deployed-digests,
  warning when a recorded tag changed digest; the workflow prints the pushed digests; kvitt_cicd needs
  only write:package.
- Dev stack: up.sh stages only fcm-service-account.json into infra/dev/secrets/ (git-ignored), mounted
  read-only at /secrets.
- README: restricted cert-sync key required (plain root key not acceptable), remote_ip and log checks,
  APK download note, owner decisions (backup encryption, APK limit, key form, token scope), overhaul lines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/pi/install.sh

@@ -8,7 +8,8 @@
 #  4. trusts the plain-HTTP registry in /etc/docker/daemon.json (insecure-registries) and logs in when credentials are set
 #  5. copies compose.yaml, Caddyfile, .env and the operation scripts to /opt/kvitt; a KVITT_TAG that deploy.sh set
 #     in /opt/kvitt/.env is kept, so re-running an older bundle never rolls the server back to the bundle's tag
-#  6. pulls the images, gives the named volumes their owners, starts the stack, waits for /health
+#  6. pulls the images (digests recorded in /opt/kvitt/deployed-digests), gives the named volumes their owners,
+#     starts the stack, waits for /health
 # Uses sudo for /opt/kvitt, the secret files and the Docker daemon configuration.
 set -euo pipefail
 bundle="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
@@ -35,7 +36,8 @@ registry_host=${registry%%/*}
 registry_user=$(env_value KVITT_REGISTRY_USER "$env_src")
 registry_token=$(env_value KVITT_REGISTRY_TOKEN "$env_src")
 
-# 3. Directories and secrets. uid 1000 = cert-sync, uid 10001 = server and backup (SPEC §10.2, §10.7, D-023, D-105).
+# 3. Directories and secrets. uid 1000 = cert-sync, uid 10001 = server and backup, uid 10002 = caddy (SPEC §10.2,
+# §10.7, D-023, D-105, D-117).
 say "Creating $KVITT_DIR"
 sudo install -d -m 0755 -o "$(id -u)" -g "$(id -g)" "$KVITT_DIR" "$KVITT_DIR/import" "$KVITT_DIR/apk"
 sudo install -d -m 0700 -o root -g root "$KVITT_DIR/secrets"
@@ -125,13 +127,17 @@ say "Installed compose.yaml, Caddyfile, .env and the scripts in $KVITT_DIR"
 # 6. Pull, volume owners, start.
 compose config --quiet
 compose pull
+record_digests "$(env_value KVITT_TAG)"
 compose create
 # Named volumes start owned by root; give each its container's uid (the server image has no shell, so the
 # backup image, which mounts the same data volume, sets /data). Runs as root once per install, then exits.
 compose run --rm --no-deps -T --user 0:0 --cap-add CHOWN --entrypoint /bin/sh backup \
   -c 'chown 10001:10001 /data /backups && mkdir -p /data/apk && chown 10001:10001 /data/apk'
-compose run --rm --no-deps -T --user 0:0 --cap-add CHOWN --entrypoint /bin/sh cert-sync \
-  -c 'chown 1000:1000 /certs'
+# /certs: cert-sync (1000) writes, Caddy (10002, supplementary group 1000) reads; /data of Caddy: 10002 (D-117).
+compose run --rm --no-deps -T --user 0:0 --cap-add CHOWN --cap-add FOWNER --entrypoint /bin/sh cert-sync \
+  -c 'chown 1000:1000 /certs && chmod 0750 /certs'
+compose run --rm --no-deps -T --user 0:0 --cap-add CHOWN --entrypoint /bin/sh caddy \
+  -c 'chown -R 10002:10002 /data'
 compose up -d --remove-orphans
 ok=1
 wait_healthy server 180 || ok=0