security: headers, phone ACL, PIN rules for PINs set from the phone

Headers (08 §2.4) on every response: CSP (connect-src also allows
WEBRTC_WS_URL's origin when set), nosniff, Referrer-Policy,
Permissions-Policy. The dark-mode bootstrap moved from an inline
<script> to /theme.js so script-src stays 'self'.

Phone ACL (08 §2.2): with sip.restrictPhonesToLocalNets, every desk
extension endpoint gets deny 0.0.0.0/0 and permit for each local and
extra net. The spec's snippet was wrong: contact_acl names acl.conf
sections, a pjsip type=acl is the global ACL (it would filter trunks),
and Contact-header rules let a NATed remote phone through. Browser
endpoints come through the reverse proxy and aren't filtered. Golden
case phone-acl. Settings → Security holds it, with the provisioning
switches.

PIN rules for PINs changed from the phone's voicemail menu, which went
around the api: externpasscheck = sp-vm-pincheck (in the Asterisk
image, same rules as isTrivialPin, a unit test keeps them in step) and
minpassword = 4. Accepted PINs reach the api through AMI
VoicemailPasswordChange and are stored; before, the next config write
silently put the old PIN back.

e2e m11-t1: no CSP violations across admin pages; Asterisk refuses a
REGISTER ("Not match Endpoint ACL") until the network is listed; from
the phone, 1111 is refused by the check script and 7391 is stored and
survives a later config write.

Task: M11-T1

apps/api/test/auth.test.ts

@@ -148,4 +148,16 @@ describe.skipIf(!hasTestDb)('auth', () => {
     expect((await get('/api/nope')).statusCode).toBe(404);
     expect((await get('/prov/x.cfg')).statusCode).toBe(404);
   });
+
+  it('M11-T1: security headers on every response (08 §2.4)', async () => {
+    for (const url of ['/admin/users', '/api/nope', '/healthz']) {
+      const h = (await get(url)).headers;
+      expect(h['content-security-policy'], url).toBe(
+        "default-src 'self'; connect-src 'self' wss://pbx.test; media-src 'self' blob:; img-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'",
+      );
+      expect(h['x-content-type-options']).toBe('nosniff');
+      expect(h['referrer-policy']).toBe('same-origin');
+      expect(h['permissions-policy']).toBe('microphone=(self), camera=()');
+    }
+  });
 });