Switch to SQLite-backed session storage, cleanup third-party dependencies, and refine CSP for restricted external assets.

test/app.test.js

@@ -127,14 +127,15 @@ test("public health checks reach the backend without exposing diagnostics or req
     assert.equal((await request(server.baseUrl, "/admin/diagnostics")).status, 403);
 });
 
-test("CSP permits the pinned chat markdown script and the app's hosted fonts", async t => {
+test("CSP restricts scripts, styles, and fonts to local assets", async t => {
     const server = await startTestServer();
     t.after(() => server.close());
     const response = await fetch(`${server.baseUrl}/`);
     const policy = response.headers.get("content-security-policy");
-    assert.match(policy, /style-src[^;]*https:\/\/fonts\.googleapis\.com/);
-    assert.match(policy, /script-src[^;]*https:\/\/cdnjs\.cloudflare\.com/);
-    assert.match(policy, /font-src[^;]*https:\/\/fonts\.gstatic\.com/);
+    assert.match(policy, /style-src 'self'/);
+    assert.match(policy, /script-src 'self'/);
+    assert.match(policy, /font-src 'self'/);
+    assert.doesNotMatch(policy, /unsafe-inline|cdnjs\.cloudflare\.com|fonts\.googleapis\.com|fonts\.gstatic\.com/);
 });
 
 test("personality API keeps prompts private, validates IDs, and enforces chat ownership", async t => {