feat(delivery): phase 12 — the container, and the defect only a proxy could find

PLAN.md §13 phase 12, the last one. Four decisions of record, D54–D57, taking the
count to fifty-seven; recorded in §6, "How phase 12 delivered it".

A two-stage Dockerfile, a pull-only docker-compose.yml carrying both bind mounts,
.env.example, the workflow that publishes and deploys, CONTRIBUTING.md, the
community-health files this was the only repository of the ten to lack, and
DEPLOY.md.

D54 — a merge deploys, amending D6. build-image.yml pushes
runicgateway-site:latest and :sha-<7>, then rolls the container over on the
`rgcom` runner out of /opt/runicgateway.com, and waits for the container's own
healthcheck rather than for `up -d` to return.

D55 — the site runs on its own host behind a generic reverse proxy, so DEPLOY.md
states the four requirements rather than one worked example, and the container
binds 127.0.0.1 so the safe configuration is the default.

D56 — @astrojs/node derives the request protocol from req.socket.encrypted and
never reads x-forwarded-proto, so behind a TLS-terminating proxy the browser sends
Origin: https://… while the container computes http://… and Astro's CSRF check
compares them for equality. Every beta signup, from every visitor, was answered
403. serve.mjs now normalises both forwarded headers, unconditionally — the image
should deploy and work. Two assertions in test/headers.test.mjs hold both halves.

D57 — DEPLOY.md rather than a README section; SECURITY.md and CODE_OF_CONDUCT.md
are pointers to the org's copies rather than copies, because a copy would hard-code
the contact address D13 confines to brand.json.

Verified: npm run verify green (eleven checks, 36 unit tests, 7 served tests,
astro check 0 errors). The image was built and run with both mounts — a mounted
brand reached 51 files and all 50 search pages, /brand/* fell back per file, a
proxy-shaped signup reached the store, and the export CLI wrote both Play files to
the host mount. docker compose config caught a YAML trap in the healthcheck: a
block sequence reads the `: ` in `r.ok ? 0 : 1` as a mapping.

Co-Authored-By: Claude <noreply@anthropic.com>

test/headers.test.mjs

@@ -133,4 +133,61 @@ describe('the headers the server sends', { skip: built ? false : 'no build in di
       assert.ok(!scriptSrc.includes("'unsafe-inline'"), `${route} script-src allows unsafe-inline`);
     }
   });
+
+  /**
+   * D56, phase 12. The signup POST behind a TLS-terminating proxy.
+   *
+   * `@astrojs/node` derives the request URL's protocol from `req.socket.encrypted` and
+   * never reads `x-forwarded-proto`, so a container reached over plaintext by a proxy
+   * computes `http://<host>` while the browser is sending `Origin: https://<host>`. Astro's
+   * CSRF middleware compares those two for equality, so the answer is 403 — for every
+   * visitor, on the only page that accepts a POST.
+   *
+   * This is the shape of a request as a proxy actually delivers it, and it belongs in this
+   * file rather than in `npm test` for the same reason everything else here does: the build
+   * was already correct, the store was already correct, and the failure existed only in the
+   * bytes on the wire. `serve.mjs` normalises both forwarded headers; these assertions are
+   * what stop that being deleted as unnecessary.
+   *
+   * It stops at the origin check deliberately — a signup that reached the store would write
+   * a row into whatever `data/` the developer running the suite happens to have.
+   */
+  it('accepts a form POST forwarded by a proxy that terminated TLS', async () => {
+    const host = 'runicgateway.com';
+    const res = await fetch(base + '/beta/', {
+      method: 'POST',
+      redirect: 'manual',
+      headers: {
+        host,
+        origin: `https://${host}`,
+        'x-forwarded-proto': 'https',
+        'x-forwarded-host': host,
+        'x-forwarded-for': '203.0.113.7',
+        'content-type': 'application/x-www-form-urlencoded',
+      },
+      // No form token, so the signup refuses it — but it must refuse it as a stale form,
+      // rendering the page, rather than as a cross-site request.
+      body: 'email=&consent=&ts=',
+    });
+
+    assert.notEqual(res.status, 403, 'the proxy-shaped POST was refused as cross-site (D56)');
+    assert.equal(res.status, 200);
+  });
+
+  it('still refuses a genuinely cross-site POST', async () => {
+    const res = await fetch(base + '/beta/', {
+      method: 'POST',
+      redirect: 'manual',
+      headers: {
+        host: 'runicgateway.com',
+        origin: 'https://not-us.example.com',
+        'x-forwarded-proto': 'https',
+        'x-forwarded-host': 'runicgateway.com',
+        'content-type': 'application/x-www-form-urlencoded',
+      },
+      body: 'email=&consent=&ts=',
+    });
+
+    assert.equal(res.status, 403, 'the forwarded-header fix weakened the CSRF check');
+  });
 });