fix(learner): remove the SPA proxy; CSP as a meta tag in index.html (ruling R16)

The proxy, its internal server, Unix socket and NO_PROXY changes are gone; main.ts serves the HTML
import directly again. apps/web/index.html carries the SPA policy as <meta http-equiv=CSP> ahead of every
script (script-src 'self' plus the hash of Bun's dev-server helper, no unsafe-inline/eval; no
frame-ancestors, which meta cannot carry). Dev HMR connects under it. The runner frame keeps its header CSP.

Tests: the served index.html (prod and dev, in a subprocess) has the meta policy and every inline script
is hash-covered; the XSS browser test fails with the sanitizer disabled and passes with it, and the meta
CSP alone blocks unsanitized handlers (with a no-CSP control); no source assigns proxy env vars, and the
feature leaves them untouched at runtime. Contract request 5 asks core for frame-ancestors/X-Frame-Options.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/main.ts

@@ -2,7 +2,7 @@ import type { AppConfig, AuthService, Feature, JobHandler, JobQueue, ServerConte
 import { createApp, createJobQueue, loadConfig } from "@stc/core";
 import { createCourseRepository } from "@stc/course-format";
 import { connect, migrate } from "@stc/db";
-import { learnerFeature, spaWithCsp } from "@stc/feature-learner";
+import { learnerFeature } from "@stc/feature-learner";
 import indexHtml from "../../web/index.html";
 
 // Used until a feature supplies an `auth` service (the learner package does).
@@ -31,19 +31,16 @@ export async function startServer(
   ctx.jobs = jobs;
   const app = createApp(ctx, built);
   jobs.start();
-  // The SPA document carries a CSP header (served through spaWithCsp; contract request learner §5).
-  const spa = spaWithCsp(indexHtml, { development: process.env.NODE_ENV !== "production" });
   const server = Bun.serve({
     port: config.port,
     // Bun routes win over fetch; "/api/*" falls through to the composed app (404 for unknown API paths).
-    routes: { ...app.routes, "/api/*": (req) => app.fetch(req), ...spa.routes },
+    routes: { ...app.routes, "/api/*": (req) => app.fetch(req), "/*": indexHtml },
     fetch: (req) => app.fetch(req),
   });
   return {
     server,
     async stop() {
       await server.stop(true);
-      spa.stop();
       await jobs.stop();
       await db.close();
     },