Secure dashboard rendering and authenticated ingress

[fedoseevstanislav]

Summary

Hardens the optional Murmur dashboard against DOM XSS, unauthenticated browser access, and unsigned/spoofed live NATS messages.

• renders every untrusted field through DOM textContent; removes innerHTML, inline scripts, and inline event handlers
• serves a strict CSP plus clickjacking, MIME-sniffing, referrer, opener, resource, and cache protections
• requires Basic authentication backed by a private server-local token file for HTTP and WebSocket access
• verifies envelope schema, signature, NATS subject/recipient binding, local traffic direction, and known peer identity before a live message reaches the UI
• decrypts only verified local inbound or self-originated outbound envelopes
• treats local SQLite history as authenticated daemon-store provenance and labels it accordingly
• keeps the listener loopback-only and rejects unsafe agent identifiers

Deployment note

The dashboard now fails closed unless DASHBOARD_TOKEN_FILE exists (default: ~/.config/murmur/dashboard-token), contains at least 32 URL-safe characters, and has no group/other permission bits. This dashboard is inactive in the current audited deployment, so the PR does not interrupt the running Murmur agents.

Verification

• npm run build
• npm test (all suites passed: 191 Node tests plus Python/smoke stages)
• node --test tests/dashboard-security.test.mjs (6/6)
• git diff --check
• credential-pattern scan over every changed file
• sanitized compatibility check against three live configurations: 11/11 agent and peer identifiers accepted; no values were printed

Tracks fedoseevstanislav/ops#742.