merge: restrictive CSP and narrowed asset scope (C1, C2)

Set a CSP with script-src 'self' (Tauri nonces the one inline bootstrap script),
object-src/frame-src 'none', and necessarily-permissive img/media/connect for the
user-supplied Jellyfin origin. Narrow assetProtocol $APPDATA/** -> thumbnails/**,
which is convertFileSrc's only remaining caller.

Conflict resolution: scripts/extract-traces.test.ts pinned counts summed rather
than side-picked — DR-189 and DR-198 were added independently on two branches,
so DR 187 -> 189 and total 330 -> 332. docs/traceability.md regenerated.

src-tauri/Cargo.toml

@@ -23,11 +23,15 @@ debug = "line-tables-only"
 tauri-build = { version = "2", features = [] }
 
 [dependencies]
-# protocol-asset serves downloaded media and cached thumbnails to the webview
-# over http://asset.localhost; without it convertFileSrc yields a URL nothing
-# answers. Paired with app.security.assetProtocol in tauri.conf.json, which
-# scopes it to $APPDATA/**.
-# TRACES: UR-071 | DR-134
+# protocol-asset serves cached thumbnails to the webview (asset://localhost on
+# Linux/macOS, http://asset.localhost on Windows/Android); without it
+# convertFileSrc yields a URL nothing answers. Paired with
+# app.security.assetProtocol in tauri.conf.json, which scopes it to
+# $APPDATA/thumbnails/** — the one directory still read through this protocol.
+# Downloaded media went the same way until DR-137 moved it to the loopback media
+# server, so the database, the encrypted-token fallback file and downloads/ are
+# all outside the grant now.
+# TRACES: UR-012, UR-071 | DR-134, DR-137, DR-198
 tauri = { version = "2", features = ["protocol-asset"] }
 tauri-plugin-opener = "2"
 tauri-plugin-os = "2"

src-tauri/src/lib.rs

@@ -1029,16 +1029,23 @@ fn set_env_if_unset(key: &str, value: &str) {
     }
 }
 
-/// Downloaded media and cached thumbnails are handed to the webview as
-/// `http://asset.localhost/…` URLs by `convertFileSrc`. Tauri only answers that
+/// Cached thumbnails are handed to the webview as asset-protocol URLs by
+/// `convertFileSrc` (`asset://localhost/…` on Linux/macOS,
+/// `http://asset.localhost/…` on Windows/Android). Tauri only answers that
 /// origin when the `protocol-asset` cargo feature is compiled in *and*
-/// `app.security.assetProtocol.enable` is set in `tauri.conf.json`, which also
-/// scopes it to `$APPDATA/**` — the storage root holding the database,
-/// `downloads/` and the thumbnail cache. Both are required together: with either
-/// missing the URL resolves to nothing and the webview reports
-/// `NETWORK_NO_SOURCE`, which is how offline video came to fail silently.
+/// `app.security.assetProtocol.enable` is set in `tauri.conf.json`. Both are
+/// required together: with either missing the URL resolves to nothing and the
+/// webview reports `NETWORK_NO_SOURCE`, which is how offline video came to fail
+/// silently.
 ///
-/// TRACES: UR-071 | DR-134
+/// The scope is `$APPDATA/thumbnails/**`, not the storage root: downloaded media
+/// moved to the loopback media server in DR-137, so `imageCache` is the only
+/// remaining `convertFileSrc` caller and the database and the encrypted-token
+/// fallback file — which share that root — never need to be readable by the
+/// webview. Widen it only if something other than thumbnails starts resolving
+/// through `convertFileSrc` again.
+///
+/// TRACES: UR-012, UR-071 | DR-134, DR-137, DR-198
 #[cfg_attr(mobile, tauri::mobile_entry_point)]
 pub fn run() {
     // Initialize logger

src-tauri/tauri.conf.json

@@ -18,10 +18,11 @@
       }
     ],
     "security": {
-      "csp": null,
+      "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data: blob: asset: http://asset.localhost http: https:; media-src 'self' blob: asset: http://asset.localhost http://127.0.0.1:* http: https:; connect-src 'self' ipc: http://ipc.localhost http: https:; worker-src 'self' blob:; object-src 'none'; frame-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'",
+      "devCsp": "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data: blob: asset: http://asset.localhost http: https:; media-src 'self' blob: asset: http://asset.localhost http://127.0.0.1:* http: https:; connect-src 'self' ipc: http://ipc.localhost http: https: ws: wss:; worker-src 'self' blob:; object-src 'none'; frame-src 'none'; base-uri 'self'; form-action 'self'",
       "assetProtocol": {
         "enable": true,
-        "scope": ["$APPDATA/**"]
+        "scope": ["$APPDATA/thumbnails/**"]
       }
     }
   },