Add browser security headers, implement upload temp directory management, and enhance SSE handling.

src/app.js

@@ -220,6 +220,17 @@ function sameOriginProtection(config) {
     };
 }
 
+function browserSecurityHeaders(config) {
+    return (_req, res, next) => {
+        res.setHeader("Content-Security-Policy", "default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; form-action 'self'; img-src 'self' data: blob:; media-src 'self' blob:; connect-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline'; font-src 'self' data:; worker-src 'self' blob:");
+        res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
+        res.setHeader("Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=(), usb=()");
+        res.setHeader("X-Content-Type-Options", "nosniff");
+        if (process.env.NODE_ENV === "production" && config.cookieSecure) res.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
+        next();
+    };
+}
+
 function enforceSessionVersion(repositories) {
     return (req, res, next) => {
         if (!req.session.user) return next();
@@ -249,6 +260,7 @@ export function createApp(options = {}) {
     if (config.dbPath !== ":memory:") {
         fs.mkdirSync(config.dataDir, {recursive: true});
         fs.mkdirSync(config.sessionsDir, {recursive: true});
+        fs.mkdirSync(config.uploadTmpDir, {recursive: true});
     }
 
     const closeHandlers = createLifecycleMonitors(app, config);
@@ -271,6 +283,7 @@ export function createApp(options = {}) {
     );
 
     app.use(observability.middleware);
+    app.use(browserSecurityHeaders(config));
     app.use(createHealthRouter({modelService}));
     app.use(express.json({limit: "1mb"}));
     app.use(session({