Merge remote-tracking branch 'origin/fix/ci-github-rate-limit' into develop

The test workflow was hitting GitHub's unauthenticated API rate
limit (60 req/hour) when downloading 95 packages via composer
install --prefer-dist, causing 429 Too Many Requests errors.

Two fixes applied:
1. Cache Composer's download cache (~/.composer/cache) keyed on
   composer.lock hash, so repeated CI runs don't re-download
   packages at all.
2. Configure GitHub OAuth token via SYNC_GITHUB_TOKEN secret to
   raise the rate limit to 5,000 req/hour for cache misses.

.gitea/workflows/tests.yaml

@@ -26,6 +26,24 @@ jobs:
           coverage: xdebug
           ini-values: apc.enable_cli=1
 
+      # Authenticate to GitHub to raise API rate limit from 60 → 5,000 req/hour.
+      # Uses the same token that publish.yaml uses to sync to GitHub.
+      - name: Configure GitHub OAuth token
+        env:
+          GITHUB_TOKEN: ${{ secrets.SYNC_GITHUB_TOKEN }}
+        run: composer config --global github-oauth.github.com "$GITHUB_TOKEN"
+
+      # Cache Composer's download cache so repeated CI runs don't re-download
+      # packages at all. Keyed on composer.lock hash — cache busts automatically
+      # when dependencies change.
+      - name: Cache Composer dependencies
+        uses: actions/cache@v4
+        with:
+          path: ~/.composer/cache
+          key: composer-${{ runner.os }}-${{ hashFiles('composer.lock') }}
+          restore-keys: |
+            composer-${{ runner.os }}-
+
       - name: Install dependencies
         run: composer install --prefer-dist --no-progress
 

src/Listener/SecurityHeadersListener.php

@@ -4,6 +4,7 @@ declare(strict_types=1);
 
 namespace App\Listener;
 
+use App\Service\DomainInterface;
 use Symfony\Component\EventDispatcher\Attribute\AsEventListener;
 use Symfony\Component\HttpFoundation\Response;
 use Symfony\Component\HttpKernel\Event\ResponseEvent;
@@ -15,6 +16,11 @@ use Symfony\Component\HttpKernel\Event\ResponseEvent;
  */
 final readonly class SecurityHeadersListener
 {
+    public function __construct(
+        private DomainInterface $domainManager,
+    ) {
+    }
+
     #[AsEventListener(priority: 0)]
     public function onKernelResponse(ResponseEvent $event): void
     {
@@ -36,11 +42,24 @@ final readonly class SecurityHeadersListener
 
         /* Content-Security-Policy — the login page uses inline styles
          * and scripts (via Twig includes), so we allow 'unsafe-inline'
-         * for those. No external resources are loaded. */
-        $headers->set(
-            'Content-Security-Policy',
-            "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline';"
-        );
+         * for those. No external resources are loaded.
+         *
+         * When subdomain redirection is off (or the request is not on
+         * the auth subdomain), the login form is served inline on the
+         * protected host and submission is performed via a same-origin
+         * fetch() call in _script.html.twig. That fetch is blocked by
+         * the default 'none' policy, so we add connect-src 'self' only
+         * in that case — the least privilege needed to make the form
+         * work. On the auth subdomain the form POSTs normally and no
+         * inline script is included, so the stricter policy applies. */
+        $inlineScript = $this->domainManager->getAuthSubdomain() !== $event->getRequest()->getHost();
+        $csp          = "default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline';";
+
+        if ($inlineScript) {
+            $csp .= " connect-src 'self';";
+        }
+
+        $headers->set('Content-Security-Policy', $csp);
 
         /* HSTS — enforce HTTPS for one year (app is designed for HTTPS behind a proxy) */
         $headers->set('Strict-Transport-Security', 'max-age=31536000');