Infra security fixes: Caddy log redaction, headers and non-root container; dev mounts only the FCM key; deploy records image digests (D-117)

- Caddyfile: access and error logs replace the /i/<code> segment and every query string with REDACTED
  (regexp filter on request>uri); Authorization stays redacted by default. Deferred response headers:
  Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy.
- Pi compose: caddy as uid 10002 with group 1000, read-only root, cap_drop ALL plus NET_BIND_SERVICE
  (needed to exec the image's file-capability binary), tmpfs /config and /tmp; install.sh sets /certs
  0750 1000:1000 and Caddy's /data to 10002.
- deploy.sh and install.sh print the pulled image digests and append them to /opt/kvitt/deployed-digests,
  warning when a recorded tag changed digest; the workflow prints the pushed digests; kvitt_cicd needs
  only write:package.
- Dev stack: up.sh stages only fcm-service-account.json into infra/dev/secrets/ (git-ignored), mounted
  read-only at /secrets.
- README: restricted cert-sync key required (plain root key not acceptable), remote_ip and log checks,
  APK download note, owner decisions (backup encryption, APK limit, key form, token scope), overhaul lines.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/pi/lib.sh

@@ -66,3 +66,36 @@ print_health() {
   say "GET https://$PUBLIC_HOST:$PUBLIC_PORT/health (via this Pi) failed: $out"
   return 1
 }
+
+# Print the registry digest of every image the stack runs and append one line per image to
+# $KVITT_DIR/deployed-digests: "<UTC time> <KVITT_TAG> <image reference> <digest>" (D-117). The registry is plain
+# HTTP on the LAN (D-001), so a swapped image would otherwise go unnoticed: a tag that was recorded before with a
+# different digest prints a WARNING (expected only for a tag like `latest` that is meant to move).
+record_digests() {
+  local tag=$1 log=$KVITT_DIR/deployed-digests stamp ref repo digest prev d
+  local -a refs repo_digests
+  stamp=$(date -u +%Y-%m-%dT%H:%M:%SZ)
+  mapfile -t refs < <(compose config --images)
+  touch "$log"
+  say "Image digests (also in $log):"
+  for ref in "${refs[@]}"; do
+    [[ -n "$ref" ]] || continue
+    digest=""
+    if [[ "$ref" == *@sha256:* ]]; then
+      digest=${ref#*@}
+    else
+      repo=${ref%:*}
+      read -r -a repo_digests <<< "$(docker image inspect --format '{{range .RepoDigests}}{{.}} {{end}}' "$ref" 2>/dev/null || true)"
+      for d in "${repo_digests[@]}"; do
+        if [[ "$d" == "$repo@"* ]]; then digest=${d#*@}; break; fi
+      done
+    fi
+    [[ -n "$digest" ]] || digest=unknown
+    prev=$(awk -v r="$ref" '$3 == r { d = $4 } END { print d }' "$log")
+    if [[ -n "$prev" && "$prev" != "$digest" ]]; then
+      say "WARNING: $ref was $prev at an earlier deploy and is $digest now: the image behind this tag changed"
+    fi
+    say "  $ref $digest"
+    printf '%s %s %s %s\n' "$stamp" "$tag" "$ref" "$digest" >> "$log"
+  done
+}