Security: model budget + concurrency caps, SSRF guards, spoof-proof limits

Audit pass with the threats that actually apply to a self-hosted, account-less
app: getting the Ollama key throttled or banned, and someone grinding the app
down. Per-route windows already existed; these are the missing layers.

- lib/model-guard.ts: every route that spends a model call now takes a slot —
  60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight
  per IP, 6 in total — and the slot is released when the call finishes, on
  errors and on client disconnects. Over the concurrency cap answers 429
  kind=busy, not a punishment. Slots are taken after every cheap rejection so
  a malformed request cannot hold one (found by the new suite: early 400s
  were leaking slots).
- Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL
  in an images field made Ollama fetch an arbitrary address on our behalf.
- Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting
  to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored.
- The rate-limit identity is the LAST x-forwarded-for hop. Reading the first
  let a client spoof its own IP and dodge every per-IP limit.
- Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder
  devices cap at PUSH_MAX_SUBSCRIPTIONS (50).
- Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a
  referrer policy and a Permissions-Policy without camera/mic/geo/payment.

New tests/security-test.mjs (13 checks, registered in run-all) proves each
guard against a slow stub Ollama with deliberately tiny limits. README:
security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.

app/api/reports/route.ts

@@ -51,7 +51,16 @@ export async function POST(request: Request) {
   const line = JSON.stringify({ ...parsed.data, receivedAt: new Date().toISOString() });
   try {
     await fs.mkdir(config.reports.dir, { recursive: true });
-    await fs.appendFile(path.join(config.reports.dir, "reports.jsonl"), `${line}\n`, "utf8");
+    const file = path.join(config.reports.dir, "reports.jsonl");
+    /* Disk guard: reports are a convenience for the operator, so once the
+       file passes the cap the app stops appending (the browser's own list is
+       still the source of truth for skipping). */
+    const size = await fs.stat(file).then((stats) => stats.size).catch(() => 0);
+    if (size >= config.reports.maxBytes) {
+      console.warn("[api/reports] reports.jsonl is at its size cap — not appending");
+      return Response.json({ ok: true });
+    }
+    await fs.appendFile(file, `${line}\n`, "utf8");
   } catch {
     return Response.json({ error: "could not store the report" }, { status: 500 });
   }