Tailwind v3.4.17 → v4.3.0: drop tailwind.config.js, move @source globs into
static/css/input.css (CSS-first config), rename bare `rounded` → `rounded-sm`
in templates for the renamed v4 radius scale.
Go 1.25 → 1.26.3 (toolchain directive), modernc.org/sqlite v1.50.0 → v1.50.1,
plus indirect bumps via go get -u.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The session cookie now sets the Secure attribute (server.secure_cookies, default true). Adds chi RealIP and Recoverer middleware plus a securityHeaders middleware that emits a Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy on every response. HSTS is intentionally left to the TLS-terminating proxy.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
