Security: model budget + concurrency caps, SSRF guards, spoof-proof limits

Audit pass with the threats that actually apply to a self-hosted, account-less
app: getting the Ollama key throttled or banned, and someone grinding the app
down. Per-route windows already existed; these are the missing layers.

- lib/model-guard.ts: every route that spends a model call now takes a slot —
  60 calls per window across all clients (RATE_LIMIT_MODEL_TOTAL), 3 in flight
  per IP, 6 in total — and the slot is released when the call finishes, on
  errors and on client disconnects. Over the concurrency cap answers 429
  kind=busy, not a punishment. Slots are taken after every cheap rejection so
  a malformed request cannot hold one (found by the new suite: early 400s
  were leaking slots).
- Images must be base64 data URLs (dataUrlSchema in lib/schemas): a plain URL
  in an images field made Ollama fetch an arbitrary address on our behalf.
- Push endpoints must be a real push service (PUSH_ALLOWED_HOSTS, defaulting
  to FCM/Mozilla/Apple/WNS): the server POSTs to whatever is stored.
- The rate-limit identity is the LAST x-forwarded-for hop. Reading the first
  let a client spoof its own IP and dodge every per-IP limit.
- Disk guards: reports.jsonl stops at REPORTS_MAX_BYTES (8 MB), reminder
  devices cap at PUSH_MAX_SUBSCRIPTIONS (50).
- Security headers: frame-ancestors 'none' + X-Frame-Options DENY, nosniff, a
  referrer policy and a Permissions-Policy without camera/mic/geo/payment.

New tests/security-test.mjs (13 checks, registered in run-all) proves each
guard against a slow stub Ollama with deliberately tiny limits. README:
security notes + rate-limit tables updated. Version 0.1.3, SW -> v51.

lib/config.ts

@@ -37,6 +37,12 @@ export type ServerConfig = {
     push: number;
     chat: number;
     reports: number;
+    /** All Ollama calls together per window (account-level guard). */
+    modelTotal: number;
+    /** In-flight model calls per client IP. */
+    concurrent: number;
+    /** In-flight model calls across all clients. */
+    concurrentTotal: number;
   };
   sync: {
     /** Where opaque encrypted sync blobs live (SYNC_DIR). */
@@ -53,10 +59,20 @@ export type ServerConfig = {
     subject: string;
     /** Where push subscriptions live (PUSH_DIR). */
     dir: string;
+    /** Cap on stored subscriptions (PUSH_MAX_SUBSCRIPTIONS). */
+    maxSubscriptions: number;
+    /**
+     * Hosts the server is allowed to POST reminders to (PUSH_ALLOWED_HOSTS,
+     * comma separated). Defaults to the real push services; a self-hosted
+     * push service can be added, and the test suite points it at its own stub.
+     */
+    allowedHosts: string[];
   };
   reports: {
     /** Where reported questions are appended, one JSON line each (REPORTS_DIR). */
     dir: string;
+    /** Stop appending past this size (REPORTS_MAX_BYTES) — disk guard. */
+    maxBytes: number;
   };
 };
 
@@ -156,6 +172,12 @@ export function getServerConfig(): ServerConfig {
       chat: positiveInt(process.env.RATE_LIMIT_CHAT, 60),
       // Question reports are cheap file appends.
       reports: positiveInt(process.env.RATE_LIMIT_REPORTS, 20),
+      // Every Ollama call, all clients together: the account-level guard. A
+      // flood would otherwise get the key throttled or banned.
+      modelTotal: positiveInt(process.env.RATE_LIMIT_MODEL_TOTAL, 60),
+      // In-flight model calls: per client IP, and across all clients.
+      concurrent: positiveInt(process.env.RATE_LIMIT_CONCURRENT, 3),
+      concurrentTotal: positiveInt(process.env.RATE_LIMIT_CONCURRENT_TOTAL, 6),
     },
     sync: {
       dir: process.env.SYNC_DIR?.trim() || path.join(process.cwd(), ".freezmo", "sync"),
@@ -167,9 +189,25 @@ export function getServerConfig(): ServerConfig {
       privateKey: process.env.VAPID_PRIVATE_KEY?.trim() || "",
       subject: process.env.VAPID_SUBJECT?.trim() || "mailto:freezmo@localhost",
       dir: process.env.PUSH_DIR?.trim() || path.join(process.cwd(), ".freezmo", "push"),
+      maxSubscriptions: positiveInt(process.env.PUSH_MAX_SUBSCRIPTIONS, 50),
+      allowedHosts: (process.env.PUSH_ALLOWED_HOSTS ?? "")
+        .split(",")
+        .map((entry) => entry.trim().toLowerCase())
+        .filter(Boolean)
+        .concat(
+          process.env.PUSH_ALLOWED_HOSTS
+            ? []
+            : [
+                "fcm.googleapis.com",
+                "updates.push.services.mozilla.com",
+                ".push.apple.com",
+                ".notify.windows.com",
+              ],
+        ),
     },
     reports: {
       dir: process.env.REPORTS_DIR?.trim() || path.join(process.cwd(), ".freezmo", "reports"),
+      maxBytes: positiveInt(process.env.REPORTS_MAX_BYTES, 8 * 1024 * 1024),
     },
   };
 }