docs(website): correct the CSP delta to one directive and document the report sink

Companion to website "feat(security): soak the tightened CSP on report-only".

The plan's Phase 1 claimed a two-directive delta, one of which was adding
`form-action 'self'` as "currently absent". It was not absent. The directives
object in app.js does not list it, but the middleware runs `useDefaults: true`
and helmet's default set already supplies it, so production has been serving it
all along. The plan was written from the config rather than from the live
header; the correction, and how it was caught, are now recorded in place rather
than quietly fixed.

That leaves `frame-ancestors 'self'` -> `'none'` as the entire behavioural delta
of the phase. Worth noting that this is also the directive that most justifies a
soak: a frame-ancestors violation is reported by the browser of whoever framed
the site, so it is the only available way to discover a legitimate embed before
an enforcing policy breaks it.

Also documented:

  * POST /api/csp-report -- the same-origin sink report-to/report-uri point at,
    why it is same-origin, why it lives outside /api/v1, both wire formats, the
    Reporting-Endpoints header requirement, and the properties that make an
    unauthenticated public POST safe (always-204, caps, truncation, rate limit).
  * That the sink is scoped to the soak, so the enforce PR must decide
    explicitly whether to retire it or keep a report-to group on the enforced
    policy -- rather than leaving an orphan route behind.
  * The `[csp]` log tag in section 7.5 as the thing to watch during the soak,
    and what silence across one release means.
  * client/vite.config.js already sets `modulePreload: { polyfill: false }`, so
    the plan's inline-polyfill prerequisite was already satisfied.

api-route-inventory.json moves 199 -> 200 for the new route. That is the PR 0
freeze working as intended: the first manifest diff since the baseline is a
deliberate, reviewed one.

Co-Authored-By: Claude <noreply@anthropic.com>

website/API_V2_PLAN.md

@@ -181,22 +181,64 @@ form-action 'self';
 frame-ancestors 'none';
 ```
 
-Delta vs. the policy in `server/src/app.js` today — the whole change is two directives:
+Delta vs. the policy in `server/src/app.js` today. This was written as two directives; on
+implementation it turned out to be **one**:
 
-- **Add `form-action 'self'`** (currently absent) — blocks an injected `<form action="https://evil">`
-  from POSTing credentials off-origin, an exfil path `connect-src` doesn't cover.
-- **Tighten `frame-ancestors`** `'self'` → `'none'` — nothing legitimately frames the site.
+- ~~**Add `form-action 'self'`** (currently absent)~~ — **it was not absent.** The directives object in
+  `app.js` does not list it, but the middleware is configured `useDefaults: true`, and helmet's default
+  set already supplies `form-action 'self'` — so the header served in production has carried it all
+  along. Verified by capturing the live `Content-Security-Policy` header from the running app rather
+  than reading the config, which is how the plan got this wrong. **No behavioural change here.** It is
+  now written out explicitly in `config/csp.js` anyway: a security directive should not depend on a
+  third-party library's defaults surviving its next major version.
+- **Tighten `frame-ancestors`** `'self'` → `'none'` — nothing legitimately frames the site. **This is
+  the entire behavioural delta of the phase.**
 - Unchanged: `default-src`, `script-src`, `connect-src`, `object-src 'none'`, `base-uri 'self'`, and
   `img-src … https:` (external `BRAND_*` logo/hero and `<img>` in sanitized wiki/news bodies rely on
   `https:`).
 
+The soak is still worth running for that one directive, and arguably it is the directive that most
+needs one: a `frame-ancestors` report is generated by the browser of *whoever framed the site*, so it
+is the only way to discover that something legitimately embeds us before the enforcing policy breaks
+it. Nothing else can tell us that.
+
 **Rollout:** ship via `Content-Security-Policy-Report-Only` with `report-to` for one release, watch for
 violations, then flip to enforce.
 
 Before trusting `script-src 'self'`: Vite's build injects an inline modulepreload-polyfill `<script>`
-into `dist/index.html`, which that directive blocks (harmless, but throws a violation). Confirm it's
-disabled or set `build.modulepreload.polyfill = false` in the Vite config. (The `renderIndexHtml`
-branding injection adds only `<meta>`/`<link>` tags — no inline script, no nonce needed.)
+into `dist/index.html`, which that directive blocks (harmless, but throws a violation).
+**Already handled** — `client/vite.config.js` sets `modulePreload: { polyfill: false }`, so the build
+emits no inline bootstrap script. (The `renderIndexHtml` branding injection adds only `<meta>`/`<link>`
+tags — no inline script, no nonce needed.)
+
+### Where reports go
+
+`report-to` needs somewhere to point, so the report-only PR stands up a same-origin sink:
+**`POST /api/csp-report`** (`server/src/router/cspReport.controller.js`, wired in `app.js`). Same-origin
+on purpose — violation reports describe attacks against this site and are not handed to a third-party
+collector. It writes to the `csp` log tag and stores nothing.
+
+It is mounted outside `/api/v1`, alongside `/api/health`: the browser learns the path from the policy
+header, never from a client build, so it is not part of the versioned client contract. This is the
+`+1` in the route manifest that made PR 0 go first (see § Sequencing).
+
+Necessary properties, since it is an unauthenticated public `POST` (browsers send reports with no
+session, and gating it would silence exactly the anonymous visitors worth hearing about):
+
+- **Both wire formats.** `report-uri` (Firefox, Safari) sends `application/csp-report` with a single
+  hyphenated-key object; `report-to` (Chrome) sends `application/reports+json` with an array of
+  camelCase envelopes. Handling one silently drops half the browsers. Both directives are emitted, and
+  `report-to` additionally needs a `Reporting-Endpoints` response header or it is inert.
+- **Always 204, even for junk.** A 4xx would make the global error handler write an ERROR line quoting
+  the attacker-supplied body — turning an open endpoint into a log-flood primitive. A browser cannot
+  act on an error from a report sink anyway.
+- **Bounded everywhere:** 16 KB body cap, a per-IP rate limit, a fixed field allowlist, and every
+  logged field truncated (`script-sample` is attacker-influenced and can carry a whole inline script).
+
+**Retiring it:** the sink exists for the soak. When the tightened policy flips to enforced and the
+report-only twin is deleted, this endpoint goes with it — *unless* a `report-to` group is deliberately
+kept on the enforced policy, which is a reasonable thing to want. Decide that in the enforce PR rather
+than leaving an orphan route behind.
 
 Tracked follow-ups (own PRs):
 
@@ -302,9 +344,11 @@ proves it, with no router file moved.
   is stable). The manifest keeps only `/api/**`, `/.well-known/**`, and the internal app's routes, so
   it does not change depending on whether CI built the client. Static mounts are not API contract.
 - **The baseline already exists:** [`api-route-inventory.json`](./api-route-inventory.json) in this
-  directory is today's frozen surface — **199 API routes** (110 of them `/api/v1/admin`) plus 2
-  internal. PR 0's generator must **reproduce this file byte-for-byte**; that is PR 0's own acceptance
-  test, and it means the freeze is already in effect before the first router moves.
+  directory is the frozen surface — **199 API routes** (110 of them `/api/v1/admin`) plus 2
+  internal at the time PR 0 was written. PR 0's generator must **reproduce this file byte-for-byte**;
+  that is PR 0's own acceptance test, and it means the freeze is already in effect before the first
+  router moves. *(It did, on first run. The file has since moved to **200** — the CSP report-only PR
+  added `POST /api/csp-report`, the first deliberate, reviewed manifest diff.)*
 - **Runtime introspection, not source parsing.** It is authoritative about mounts, and the route paths
   in `admin.routes.js` sit on the line *after* `adminRouter.get(`, which defeats naive greps.
 - **Not `swagger-output.json`.** That is annotation-derived (only annotated routes appear) and churns
@@ -341,8 +385,11 @@ deliberate `+1` in the manifest — which is exactly the mechanism working as de
 
 1. **PR 0 — route manifest.** Generator + CI check + committed baseline of today's surface. No routers moved. ✅ landed
 2. **PR — CSP report-only.** Tightened policy behind `Content-Security-Policy-Report-Only` + `report-to`,
-   plus the report collector (manifest `+1`).
-3. **PR — CSP enforce.** One release later, assuming a clean violation report.
+   plus the report collector (manifest `+1` — the first deliberate, reviewed manifest diff). ✅ landed
+3. **PR — CSP enforce.** One release later, assuming a clean violation report. **Blocked on real soak
+   data**, not on code: watch the `csp` log tag for `frame-ancestors` reports across one release before
+   flipping. Also decide there whether `/api/csp-report` is retired with the report-only twin or kept
+   as a `report-to` group on the enforced policy.
 4. **PR 1 — admin:** `users`, `account`, `invites`, `auth` (providers).
 5. **PR 2 — admin:** `moderation`, `bot-activity`, `activity`.
 6. **PR 3 — admin (content):** `posts`, `pages`, `wiki`, `uploads`.