Close the review gaps: CI lint, server timeouts, security headers

The initial scaffold left three holes the review caught. CI only checked
gofmt and go vet, so golangci-lint and the pre-commit hooks were advisory
rather than enforced. The HTTP server bounded only the header read, so a
slow or stalled peer could hold a connection indefinitely. And the browser
got no content-security policy at all, leaving the SPA's same-origin
assumption unenforced.

Add golangci-lint and pre-commit hook steps to the existing pre-commit
workflow, mirroring the estate's images so the required context name stays
ci/woodpecker/pr/pre-commit.
Bound the server with ReadTimeout, WriteTimeout, and IdleTimeout, keeping
the write budget generous enough for the poster proxy's streamed responses.
Stamp Content-Security-Policy, X-Content-Type-Options, and Referrer-Policy
onto every response from a single middleware wrapping the root handler.
Assert the headers across the API, UI, assets, probes, and rejections.
Guard the CSP's no-unsafe-inline assumption with a ui test that fails if a
shipped asset grows an inline script, style block, or event handler.
Extend the make pre-commit target to match the widened CI checks.

internal/server/server.go

@@ -62,7 +62,24 @@ func (s *Server) Handler() http.Handler {
 	gated.HandleFunc("/", s.handleUI)
 
 	mux.Handle("/", s.gate.Wrap(gated))
-	return mux
+	return secureHeaders(mux)
+}
+
+// cspPolicy locks the page to same-origin code. The SPA carries no inline
+// script or style, so no unsafe-inline escape hatch is needed; data: is in
+// img-src solely for the inline SVG favicon.
+const cspPolicy = "default-src 'self'; img-src 'self' data:; style-src 'self'; script-src 'self'"
+
+// secureHeaders stamps the browser-facing hardening headers onto every
+// response — API, UI and probes alike — before the handler writes.
+func secureHeaders(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		h := w.Header()
+		h.Set("Content-Security-Policy", cspPolicy)
+		h.Set("X-Content-Type-Options", "nosniff")
+		h.Set("Referrer-Policy", "no-referrer")
+		next.ServeHTTP(w, r)
+	})
 }
 
 func (s *Server) readyz(w http.ResponseWriter, _ *http.Request) {