feat: harden production security boundaries

deploy/Caddyfile

@@ -14,6 +14,14 @@
     reverse_proxy web:4321
   }
 
+  @adminApi path /api/v1/admin/*
+  handle @adminApi {
+    basic_auth {
+      {$ADMIN_BASIC_USER} {$ADMIN_BASIC_PASSWORD_HASH}
+    }
+    reverse_proxy api:8000
+  }
+
   @api path /api/* /health /ready
   handle @api {
     reverse_proxy api:8000
@@ -29,6 +37,9 @@
     X-Content-Type-Options "nosniff"
     Referrer-Policy "strict-origin-when-cross-origin"
     Permissions-Policy "camera=(), microphone=(), geolocation=()"
+    X-Frame-Options "DENY"
+    Cross-Origin-Opener-Policy "same-origin"
+    Content-Security-Policy "frame-ancestors 'none'; base-uri 'self'; object-src 'none'"
   }
 }
 
@@ -40,5 +51,7 @@
     Strict-Transport-Security "max-age=31536000; includeSubDomains"
     X-Content-Type-Options "nosniff"
     Referrer-Policy "no-referrer"
+    X-Frame-Options "DENY"
+    Content-Security-Policy "default-src 'none'; img-src 'self' data:; style-src 'unsafe-inline'; sandbox"
   }
 }