feat(polish): phase 10 — search, accessibility, SEO and a real CSP

PLAN.md §13 phase 10, with four decisions of record — D47-D50, taking the count
to fifty. Three were straightforward; the CSP turned into the phase's real work,
because the thing meant to be a configuration flag was broken in a dependency and
broken silently.

D47 — search reaches the marketing pages, and the header gets a box.
Base.astro marks its <main> as a Pagefind body, so all ten join the index the
docs already query, and Search.astro opens it in a <dialog>. Nothing is fetched
until the dialog is opened (the bundle is 120 kB and these pages otherwise ship
almost no JavaScript). Pagefind titles a result from the first <h1>, and these
pages have editorial ones — "The app for a deployment you already use" — so the
index is given the page's short name instead. applyBrand.mjs now re-indexes after
a rewrite, closing a note phase 2 left for this phase.

D48 — the CSP is a real response header, sent by the container. Not a <meta>,
which ignores frame-ancestors, and not advice for someone's reverse proxy, which
puts the strictest promise in §6 outside what this repo tests. Three things
fought it, all the same shape — correct build, broken page, no error:

  * Astro does not hash <script is:inline>, and Starlight ships six per docs
    page, so the first build with CSP on had a strict header and a dead theme
    switcher. The hashes are now generated into src/config/cspHashes.mjs and
    checkCsp.mjs verifies every inline block against its own page's policy.
  * Expressive Code writes ~3,700 inline style ATTRIBUTES, which cannot be
    hashed, hence style-src-attr 'unsafe-inline' — scoped to that directive, so
    script-src is untouched.
  * @astrojs/node matched a request to a policy with pathname.includes(), a
    substring test: /modules/ was served /docs/modules/building-a-module's
    policy and rendered with its own stylesheet refused. scripts/serve.mjs keeps
    the same _headers.json and matches by equality; test/headers.test.mjs starts
    the server and reads the responses, because nothing that reads dist/ can see
    this.

D49 — robots.txt allows everything and names the sitemap (there was no way to
find it: no robots.txt, and D9 rules out a search console). D50 — Organization
and SoftwareApplication, no ratings and no docs-wide Article markup.

checkA11y.mjs is the eleventh check: seven structural rules over all fifty pages,
verified by breaking each in turn. The walk at 390/768/1280 found no overflow
anywhere, the CSP violations above, a 17x17 consent checkbox (WCAG 2.2 SC 2.5.8
wants 24), and a skip link that moved the scroll but not the focus.

npm run verify is green: fourteen steps, both test suites, all eleven checks.

Co-Authored-By: Claude <noreply@anthropic.com>

src/config/cspHashes.mjs

@@ -0,0 +1,41 @@
+/**
+ * cspHashes.mjs — GENERATED. Do not edit by hand.
+ *
+ * Regenerate with `npm run csp:hashes` (which builds, harvests and rebuilds).
+ * `npm run check:csp` fails if this file no longer covers what the build emits.
+ *
+ * ── Why this file exists ────────────────────────────────────────────────────
+ * Astro's `security.csp` (D48) hashes the scripts and styles it processes itself. It does
+ * not hash `<script is:inline>` — by design, because an inline script is the author's own
+ * text and Astro never parses it. Starlight ships six of them on every documentation page:
+ * the theme provider, the theme-picker sync, the mobile menu, the sidebar scroll restore.
+ *
+ * That combination fails in the worst way available. The build succeeds, the header is
+ * strict and correct, every page renders — and the theme switch, the mobile sidebar and
+ * the sidebar's scroll position are dead, with the explanation only in a browser console
+ * nobody opens. `'unsafe-inline'` would fix all six and give up the single directive CSP
+ * exists to enforce, so instead the hashes are enumerated here and checked.
+ *
+ * These are Starlight's, not ours: a Starlight upgrade that edits one byte of one of those
+ * scripts invalidates a hash. `check:csp` is what turns that from a silent breakage into a
+ * red build, and regenerating this file is the acknowledgement that the upgrade was read.
+ */
+
+/**
+ * SHA-256 hashes of inline `<script>` bodies Astro does not hash for us.
+ *
+ * The template-literal type is not decoration: Astro types this option as `CspHashEntry[]`,
+ * so a plain `string[]` fails `astro check`.
+ *
+ * @type {`sha256-${string}`[]}
+ */
+export const inlineScriptHashes = [
+  'sha256-7eCV4jtsr4t4knb3c4FCRPeu7GGZeOUGE3XvWix0XOQ=',
+  'sha256-GkZBRnvSuhtx/cvzvukVkX2JJZW+DdPlVr7BX8Tefqo=',
+  'sha256-VWo5Wp4aqSj6nSgMpeAp9cKieaoIfwFUAunAVugI5gA=',
+  'sha256-f/zAUE74ucc3JYp4r4QQvkJofoQdkOIhHYK+jeZ6eko=',
+  'sha256-wX2yOADeV+NMngflD5uYi3vl50SHC4sfM1EmylVjlX4=',
+];
+
+/** @type {`sha256-${string}`[]} SHA-256 hashes of inline `<style>` bodies Astro does not hash. */
+export const inlineStyleHashes = [];