server/server.js — added helmet with CSP configured to allow Google Fonts

Dockerfile — creates a non-root app user and runs the process under it
server/routes.js — tailscale_ip validated against IPv4 regex (empty string still allowed)
index.html — sql.js CDN script tag already removed earlier in this session

Dockerfile

@@ -1,4 +1,6 @@
 FROM node:lts-alpine
+RUN addgroup -S app && adduser -S app -G app
+
 WORKDIR /app
 
 COPY package*.json ./
@@ -8,5 +10,8 @@ COPY . .
 RUN awk -F'"' '/"version"/{printf "const VERSION = \"%s\";\n", $4; exit}' \
     package.json > js/version.js
 
+RUN chown -R app:app /app
+USER app
+
 EXPOSE 3000
 CMD ["node", "server/server.js"]