buildCSP (api/secheaders.go)

Middleware that injects security headers, including CSP, into all HTTP responses.

// Source: https://github.com/superbasedapp/observer | License: Apache-2.0 | Copyright 2026 Gaja AI
// Provided via justclaw.it.com; keep this notice with the code.
// secheaders.go — the security-response-header middleware (gap 3.3). It
// wraps the WHOLE mux in Handler() so every response — /healthz, every
// /portal/* UI/API route, and the two webhooks — carries the same set of
// browser-defensive headers. There is no per-route opt-out: a header that
// only some responses carry is a header a future route can forget.
//
// Sources consulted for the Paddle-specific CSP entries (2026-09-11):
//   - https://developer.paddle.com/paddle-js/about/include-paddlejs — the
//     ONLY documented script host is https://cdn.paddle.com/paddle/v2/paddle.js
//     ("Always load Paddle.js directly fro

... (truncated -- full source via MCP)