fix(security): Add security headers and harden external link rendering

.github/PULL_REQUEST_TEMPLATE.md

@@ -24,8 +24,8 @@
 
 ## Checklist
 
-- [ ] `npm run lint` passes
-- [ ] `npm test` passes
-- [ ] `npm run build` passes (includes typecheck)
+- [ ] `bun run lint` passes
+- [ ] `bun run test` passes
+- [ ] `bun run build` passes (includes typecheck)
 - [ ] New logic in `src/lib/` has colocated unit tests
 - [ ] I kept the change focused on a single concern

.github/workflows/ci.yml

@@ -11,19 +11,18 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: actions/setup-node@v4
+      - uses: oven-sh/setup-bun@v2
         with:
-          node-version: 22
-          cache: npm
+          bun-version: latest
 
       - name: Install dependencies
-        run: npm ci
+        run: bun install --frozen-lockfile
 
       - name: Lint
-        run: npm run lint
+        run: bun run lint
 
       - name: Test
-        run: npm test
+        run: bun run test
 
       - name: Build
-        run: npm run build
+        run: bun run build

CONTRIBUTING.md

@@ -9,11 +9,11 @@ the conventions the codebase follows, and what to expect from the review process
 2. Install dependencies and start the dev server:
 
    ```sh
-   npm install
-   npm run dev
+   bun install
+   bun run dev
    ```
 
-   Requires Node.js 20+. The dev server proxies API calls to
+   Requires [Bun](https://bun.sh) 1.1+. The dev server proxies API calls to
    `https://node.gitlawb.com` — no backend setup needed.
 
 3. Create a branch off `main` for your change:
@@ -27,14 +27,32 @@ the conventions the codebase follows, and what to expect from the review process
 Run the full check suite locally — CI runs the same three commands:
 
 ```sh
-npm run lint
-npm test
-npm run build
+bun run lint
+bun run test
+bun run build
 ```
 
-All three must pass. `npm run build` includes the TypeScript project build
+All three must pass. `bun run build` includes the TypeScript project build
 (`tsc -b`), so type errors fail there.
 
+### Editing the security headers
+
+`vercel.json`'s `headers` block is strict JSON — it can't carry inline
+comments — so these two couplings are documented here instead:
+
+- **The CSP `script-src` hash and the inline theme script.** `index.html`'s
+  anti-FOUC theme script is allowlisted by sha256 hash rather than
+  `'unsafe-inline'`. Changing that script, even its whitespace, changes the
+  hash, and a stale hash in `vercel.json` makes the script silently stop
+  running under CSP (symptom: a theme flash on load, stored preference
+  ignored). Recompute the hash and update `script-src` whenever the script
+  changes.
+- **The CSP `connect-src` allowlist and `FEDERATED_NODES`.** `src/lib/nodes.ts`
+  lists every node host the app talks to; `vercel.json`'s `connect-src` (and
+  its per-node proxy `rewrites`) must list the same hosts. There's no CSP in
+  dev, so a host added to one but not the other passes locally and is
+  silently blocked in production.
+
 ## What makes a good PR
 
 - **Keep it focused.** One logical change per PR. Refactors, formatting sweeps, and

README.md

@@ -23,13 +23,13 @@ push events, straight from the node's REST API.
 
 ## Quick start
 
-Requires Node.js 20+.
+Requires [Bun](https://bun.sh) 1.1+.
 
 ```sh
 git clone https://github.com/Gitlawb/node-explorer.git
 cd node-explorer
-npm install
-npm run dev
+bun install
+bun run dev
 ```
 
 The dev server proxies `/api/*` and `/node-info` to `https://node.gitlawb.com`
@@ -41,12 +41,12 @@ through a same-origin proxy. To point at a different node, change the proxy
 
 | Command | What it does |
 | --- | --- |
-| `npm run dev` | Vite dev server with API proxy |
-| `npm run build` | Typecheck (`tsc -b`) + production build |
-| `npm test` | Run the unit test suite once (Vitest) |
-| `npm run test:watch` | Vitest in watch mode |
-| `npm run lint` | ESLint |
-| `npm run preview` | Serve the production build locally |
+| `bun run dev` | Vite dev server with API proxy |
+| `bun run build` | Typecheck (`tsc -b`) + production build |
+| `bun run test` | Run the unit test suite once (Vitest) |
+| `bun run test:watch` | Vitest in watch mode |
+| `bun run lint` | ESLint |
+| `bun run preview` | Serve the production build locally |
 
 ## Data source
 
@@ -67,7 +67,7 @@ opt-in via an env flag (older nodes silently ignore unknown params, which would
 search appear to return everything):
 
 ```sh
-VITE_SERVER_SEARCH=true npm run dev
+VITE_SERVER_SEARCH=true bun run dev
 ```
 
 Until the flag is on, search and sort apply to the currently loaded page and the UI
@@ -99,8 +99,8 @@ parsing, language detection, API mapping/classification, TOC extraction) is cove
 network functions are tested against a stubbed `fetch`.
 
 ```sh
-npm test              # single run
-npm run test:watch    # watch mode
+bun run test          # single run
+bun run test:watch    # watch mode
 ```
 
 Tests live next to the modules they cover (`src/lib/foo.ts` → `src/lib/foo.test.ts`).

index.html

@@ -28,7 +28,10 @@
     <link href="https://fonts.googleapis.com/css2?family=Geist+Mono:wght@400;500;600;700;800;900&family=Geist:wght@400;500;600;700;800;900&display=swap" rel="stylesheet" />
     <!-- Anti-FOUC: set theme before first paint. Stored choice wins, then the
          OS preference, then dark — which is what this audience runs and what
-         the site shipped before. -->
+         the site shipped before.
+         CSP allowlists this script by sha256 hash (vercel.json script-src) —
+         editing so much as its whitespace requires recomputing that hash or
+         the script silently stops running under CSP. -->
     <script>
       (function () {
         var stored = localStorage.getItem('gl-theme');