fix: security & privacy (rate limiter fix, csrf session cookie, logout on server, drafts stale token passw, login timing, password over 72b, JWT_SECRET complexity, SMTP TLS, CSV export neutralised, fonts bundled, upload metadata, hourly cleanup job, privacy.md report)

test/security_headers_test.go

@@ -51,6 +51,9 @@ func TestSecurityHeadersContentSecurityPolicy(t *testing.T) {
 	if strings.Contains(csp, "'unsafe-eval'") || strings.Contains(csp, "script-src 'self' 'unsafe-inline'") {
 		t.Errorf("script-src must not allow unsafe sources, got %q", csp)
 	}
+	if !strings.Contains(csp, "font-src 'self';") || strings.Contains(csp, "googleapis") || strings.Contains(csp, "gstatic") {
+		t.Errorf("fonts must come from the server itself, never a font CDN, got %q", csp)
+	}
 }
 
 func TestAllowInlineScriptsHashesOnlyInlineScripts(t *testing.T) {