Security: remote-pack RCE, i18n XSS sink, credential and container hardening - #4

…ring

Gemini accepts the key either way. The query-string form leaks: URLs reach
browser history, proxy and server access logs, and Referer headers — places the
request body never goes. utils_pure already stripped "?key=…" from error
strings, which was the tell that these URLs were being captured.

Moves all 24 call sites to the x-goog-api-key header across src/aiProvider.js,
ai_backend_module.js, tts_module.js and utils_pure_module.js, plus their
*_source.jsx originals and desktop/web-app/public mirrors. aiProvider and
ai_backend route through a shared _geminiHeaders() helper.

The key is added ONLY to generativelanguage.googleapis.com requests. The local
Flux image server and the localhost Edge TTS endpoints in ai_backend keep
plain headers — sending a user's Google key to another process is the failure
this change is meant to avoid, not introduce. Retry paths carry the header too;
the TTS retry was a separate call site from its parent request.

Removing the key from the URL without adding the header would leave every call
unauthenticated and look identical in a diff, so the new test pins both halves,
across every duplicated copy, and asserts the non-Google endpoints stay clean.

Updates the request-shape fixtures to the new contract (they pinned the old
?key= URL) and re-stamps the tts_module.js content hash in the host loader.

Full suite matches the pre-existing baseline exactly: 539 failing files, 133
failing tests, all present on clean main. No new failures.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…aint

Resource limits (CIS 16.7)
--------------------------
No compose service declared deploy.resources.limits, so any one container could
consume the host's CPU and memory — an ollama or flux run that grows without
bound takes the whole School Box down with it, including PocketBase.

Adds cpu/memory ceilings to all 19 services across the three compose files. The
existing GPU device reservations on ollama and flux are preserved alongside the
new limits.

The values are deliberately generous and env-overridable (OLLAMA_MEMORY etc.,
documented in the .env.example files). These are safety ceilings, not workload
sizing: a limit tight enough to OOM-kill legitimate inference would be a worse
outcome than the exhaustion it prevents. Ollama and flux hold model weights in
RAM, so their defaults are set high and are the ones to raise for large models.

Verified by parsing all three files: every service carries limits, GPU
reservations survive, and the top-level volumes key is intact.

SearXNG secret
--------------
Left in place, with the constraint documented. Moving it to an env var is not
possible for this image: SearXNG resolves settings only from YAML
(settings_loader.py honors SEARXNG_SETTINGS_PATH and nothing else — there is no
env interpolation), and the upstream sed-substitution trick needs a writable
settings.yml while ours is mounted read-only. The comment now records what the
key actually signs (this instance's own session cookies — not a credential to
any account or external service) and how to supply a per-install value by
mounting a replacement.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>