feat: security headers + onboarding scan & profile creation flow
Security:
- Add CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy,
Permissions-Policy as Hono middleware (after CORS)
- CORS already hardened via isTrustedOrigin (localhost, private, Tailscale)
Onboarding scan flow:
- New 'scan' step between 'integrations' and 'bot' in onboarding
- OnboardingScanProgress.tsx: progress UI with 4 phases (scanning, connecting,
building, briefing) with real-time polling
- onboarding-scan.ts: backend scan pipeline (in-memory registry, async phases)
- RPC routes: onboarding.scan + onboarding.scanStatus
- Contracts updated with new procedure definitions
Co-Authored-By: Claude Code <noreply@anthropic.com>
Ingo Wagner
20afcb0d0b