feat(api): baseline security headers; suppress the MSAL local-network prompt

@azure/msal-browser v4's silent-auth iframe sets `allow="local-network-access *"`
on itself so the embedded IdP page can probe a localhost SSO broker — which
makes Chrome prompt the user "this page wants to access your other devices"
on every fresh visit. Set `Permissions-Policy: local-network-access=(self)`
on all responses: that caps the cross-origin delegation to the
login.microsoftonline.com iframe, so the prompt never fires; the silent
flow is unaffected (it doesn't need the broker).

Also adds X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN
(not DENY — the MSAL silent iframe briefly lands back on this origin),
Referrer-Policy: strict-origin-when-cross-origin. A full CSP (DESIGN §D3)
is left for a follow-up — it needs a vite.config change to drop the inline
modulepreload polyfill first.

Author: viloforge

packages/api/src/server/app.ts

@@ -20,7 +20,7 @@
 import { existsSync } from "node:fs";
 import { dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import express, { type Express, type Request, type Response } from "express";
+import express, { type Express, type NextFunction, type Request, type Response } from "express";
 import { VERSION } from "../shared/version.js";
 import type { Verifier } from "./auth/idp.js";
 import type { Db } from "./db.js";
@@ -39,6 +39,29 @@ export function createApp(deps: AppDeps): Express {
 	const app = express();
 	app.disable("x-powered-by");
 
+	// Baseline security headers on every response.
+	//
+	// `Permissions-Policy: local-network-access=(self)` is load-bearing:
+	// `@azure/msal-browser`'s silent-auth iframe (the hidden frame it uses for
+	// SSO / token renewal) sets `allow="local-network-access *"` on itself so
+	// the embedded IdP page can probe a localhost single-sign-on broker — which
+	// makes Chrome prompt the user "this page wants to access your other
+	// devices". Capping `local-network-access` to `(self)` here means that
+	// cross-origin delegation (to the `login.microsoftonline.com` iframe) is
+	// denied, so the prompt never fires; the silent flow works fine without the
+	// broker. `X-Frame-Options` must stay SAMEORIGIN, not DENY — that same MSAL
+	// silent iframe briefly lands back on *this* origin during the handshake.
+	// (A full Content-Security-Policy is a worthwhile addition per DESIGN §D3
+	// but needs a vite.config tweak to drop the inline modulepreload polyfill
+	// first; out of scope here.)
+	app.use((_req: Request, res: Response, next: NextFunction) => {
+		res.setHeader("Permissions-Policy", "local-network-access=(self)");
+		res.setHeader("X-Content-Type-Options", "nosniff");
+		res.setHeader("X-Frame-Options", "SAMEORIGIN");
+		res.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
+		next();
+	});
+
 	app.get("/health", (_req: Request, res: Response) => {
 		res.json({ status: "ok", version: VERSION });
 	});