server/server.js — added helmet with CSP configured to allow Google Fonts

Dockerfile — creates a non-root app user and runs the process under it
server/routes.js — tailscale_ip validated against IPv4 regex (empty string still allowed)
index.html — sql.js CDN script tag already removed earlier in this session

server/server.js

@@ -1,4 +1,5 @@
 import express from 'express';
+import helmet from 'helmet';
 import { fileURLToPath } from 'url';
 import { dirname, join } from 'path';
 import { router } from './routes.js';
@@ -8,6 +9,15 @@ const PORT = process.env.PORT ?? 3000;
 
 export const app = express();
 
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      ...helmet.contentSecurityPolicy.getDefaultDirectives(),
+      'style-src':  ["'self'", 'https://fonts.googleapis.com'],
+      'font-src':   ["'self'", 'https://fonts.gstatic.com'],
+    },
+  },
+}));
 app.use(express.json());
 
 // API