fix(learner): remove the SPA proxy; CSP as a meta tag in index.html (ruling R16)

The proxy, its internal server, Unix socket and NO_PROXY changes are gone; main.ts serves the HTML
import directly again. apps/web/index.html carries the SPA policy as <meta http-equiv=CSP> ahead of every
script (script-src 'self' plus the hash of Bun's dev-server helper, no unsafe-inline/eval; no
frame-ancestors, which meta cannot carry). Dev HMR connects under it. The runner frame keeps its header CSP.

Tests: the served index.html (prod and dev, in a subprocess) has the meta policy and every inline script
is hash-covered; the XSS browser test fails with the sanitizer disabled and passes with it, and the meta
CSP alone blocks unsanitized handlers (with a no-CSP control); no source assigns proxy env vars, and the
feature leaves them untouched at runtime. Contract request 5 asks core for frame-ancestors/X-Frame-Options.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/server/src/main.ts

@@ -2,7 +2,7 @@ import type { AppConfig, AuthService, Feature, JobHandler, JobQueue, ServerConte
 import { createApp, createJobQueue, loadConfig } from "@stc/core";
 import { createCourseRepository } from "@stc/course-format";
 import { connect, migrate } from "@stc/db";
-import { learnerFeature, spaWithCsp } from "@stc/feature-learner";
+import { learnerFeature } from "@stc/feature-learner";
 import indexHtml from "../../web/index.html";
 
 // Used until a feature supplies an `auth` service (the learner package does).
@@ -31,19 +31,16 @@ export async function startServer(
   ctx.jobs = jobs;
   const app = createApp(ctx, built);
   jobs.start();
-  // The SPA document carries a CSP header (served through spaWithCsp; contract request learner §5).
-  const spa = spaWithCsp(indexHtml, { development: process.env.NODE_ENV !== "production" });
   const server = Bun.serve({
     port: config.port,
     // Bun routes win over fetch; "/api/*" falls through to the composed app (404 for unknown API paths).
-    routes: { ...app.routes, "/api/*": (req) => app.fetch(req), ...spa.routes },
+    routes: { ...app.routes, "/api/*": (req) => app.fetch(req), "/*": indexHtml },
     fetch: (req) => app.fetch(req),
   });
   return {
     server,
     async stop() {
       await server.stop(true);
-      spa.stop();
       await jobs.stop();
       await db.close();
     },

apps/web/index.html

@@ -3,6 +3,10 @@
 <head>
   <meta charset="utf-8">
   <meta name="viewport" content="width=device-width, initial-scale=1">
+  <!-- CSP (learner review C1, ruling R16). No inline script: the one hash is Bun's dev-server helper
+       (/_bun/unref beacon), which production builds do not inject. frame-ancestors cannot be set in a meta tag;
+       see docs/contract-requests/learner.md section 5. -->
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'sha256-ES8VF47udzjVFFPh4RhgcgjUrADRd1Ef0GD9UagS2mY='; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; worker-src 'self' blob:; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'">
   <title>STCourses</title>
   <link rel="stylesheet" href="../../packages/ui/src/fonts.css">
   <link rel="stylesheet" href="../../packages/ui/src/tokens.css">