fix(learner): review round 1: sanitize-html, sandboxed runner frame, one visibility rule, no Tab capture

C1: lesson HTML goes through a sanitize-html allowlist on the fully rendered output (no on* attributes, no
style, no svg/math/iframe/object/embed/form; URLs limited to http(s), mailto, relative and anchors). Raw tags
outside the allowlist are escaped as text. The SPA document is served with a CSP (script-src 'self', no inline
script) through spaWithCsp in main.ts; contract request §5 asks core to own it.

C2: exercises run in <iframe sandbox="allow-scripts"> (opaque origin, no cookies) loaded from
/api/learner/runner-frame, whose CSP allows only its own script (by hash) and blob: workers, and connect-src
'none'. postMessage only, both sides check event.source; the timeout removes the frame. The worker stubs now
also cover Worker, SharedWorker and caches.

I1: learner visibility calls core canView with per-course authorship only, like /api/media (contract request §6).
I2: Tab and Shift+Tab move focus; Enter keeps the previous line's indentation.

Tests: XSS unit cases, headless-Chrome checks for the exploit lesson and for fetch, import, Cache.add, nested
Worker, img, EventSource, WebSocket, XHR and sendBeacon from learner and test code (plus a negative control),
visibility on both dialects, SPA and runner-frame CSP headers.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/server/src/main.ts

@@ -2,7 +2,7 @@ import type { AppConfig, AuthService, Feature, JobHandler, JobQueue, ServerConte
 import { createApp, createJobQueue, loadConfig } from "@stc/core";
 import { createCourseRepository } from "@stc/course-format";
 import { connect, migrate } from "@stc/db";
-import { learnerFeature } from "@stc/feature-learner";
+import { learnerFeature, spaWithCsp } from "@stc/feature-learner";
 import indexHtml from "../../web/index.html";
 
 // Used until a feature supplies an `auth` service (the learner package does).
@@ -31,16 +31,19 @@ export async function startServer(
   ctx.jobs = jobs;
   const app = createApp(ctx, built);
   jobs.start();
+  // The SPA document carries a CSP header (served through spaWithCsp; contract request learner §5).
+  const spa = spaWithCsp(indexHtml, { development: process.env.NODE_ENV !== "production" });
   const server = Bun.serve({
     port: config.port,
     // Bun routes win over fetch; "/api/*" falls through to the composed app (404 for unknown API paths).
-    routes: { ...app.routes, "/api/*": (req) => app.fetch(req), "/*": indexHtml },
+    routes: { ...app.routes, "/api/*": (req) => app.fetch(req), ...spa.routes },
     fetch: (req) => app.fetch(req),
   });
   return {
     server,
     async stop() {
       await server.stop(true);
+      spa.stop();
       await jobs.stop();
       await db.close();
     },