chore: prepare release v0.3.0

docs/security.md

@@ -51,6 +51,26 @@ than opening a public issue.
   Requests without a valid token get `403`.
 - `SameSite=Strict` cookies provide a second, independent layer.
 
+## Content Security Policy (admin)
+
+All `/admin/*` responses send a strict **Content-Security-Policy** header:
+
+```
+default-src 'self';
+script-src 'self' 'unsafe-inline';
+style-src 'self' 'unsafe-inline';
+img-src 'self' data:;
+font-src 'self';
+connect-src 'self';
+form-action 'self';
+frame-ancestors 'none'
+```
+
+The inline allowances are required by the server-rendered admin (ERB templates
+emit small inline `<script>` blocks and inline `style=""` attributes);
+`frame-ancestors 'none'` prevents clickjacking via iframe embedding. The public
+JSON API does not set a CSP — it returns no HTML, so none is needed.
+
 ## CORS and Host handling
 
 - The public read API sends `Access-Control-Allow-Origin: *` (read-only, no
@@ -68,8 +88,15 @@ than opening a public issue.
 - `GET /media/*` resolves names with `File.basename` and an explicit
   containment check, so `../` traversal cannot read files outside the media
   directory.
-- Upload content-type is **not** validated (the `accept="image/*"` attribute is
-  only a UI hint); this is acceptable under the trusted-author model.
+- Uploads are **rejected (HTTP 413)** when the file exceeds **10 MB**
+  (`MAX_UPLOAD_BYTES`).
+- Upload MIME type is **whitelisted** to `image/webp` and `image/avif`
+  (`ALLOWED_UPLOAD_TYPES`); anything else returns **HTTP 415** with a
+  conversion hint pointing at `cwebp` / `avifenc`. This matches the
+  WebP/AVIF-only posture the engine serves content in and rejects binaries
+  (PHP, executable, …) outright.
+- Per-user profile photos go through the same upload validation and storage
+  pipeline as post media.
 
 ## Secrets and files
 
@@ -91,7 +118,9 @@ A small, audited set: `sinatra`, `kramdown` (+ `kramdown-parser-gfm`),
 
 ## Known limitations / non-goals
 
-- **No rate limiting or lockout** on `/admin/login`. Put nginx `limit_req` in
+- **No rate limiting or lockout** on `/admin/login` at the application layer
+  (the engine does have an in-memory rate limiter, but nginx is the durable
+  line of defence — see `docs/deployment.md`). Put nginx `limit_req` in
   front of it, or use fail2ban, to slow brute-force attempts.
 - **No 2FA** and **no audit log**.
 - **Raw HTML in posts is trusted** (see the trust model). There is no built-in