Privacy hardening: degoogle, security headers, referrer protection

- Replace Google Fonts with system font stacks across all themes
- Add Referrer-Policy, X-Content-Type-Options, X-Frame-Options, CSP headers
- Add rel="noreferrer noopener" on all outbound links
- Add no-referrer and dns-prefetch-control meta tags to all themes
- Clean tracking params on outbound links from trusted/remote sources
- Remove Google domains from CSP whitelists

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

handlers.py

@@ -245,7 +245,7 @@ def handle_search(query):
                     snip_html = f'<br>{esc(r["summary"])}' if r["summary"] else ""
                     result_html += (
                         f'<div class="result">'
-                        f'<a href="{esc(r["url"])}">{esc(r["title"])}</a><br>'
+                        f'<a href="{esc(r["url"])}" rel="noreferrer noopener">{esc(r["title"])}</a><br>'
                         f'<small>{esc(r["url"])}</small>'
                         f'{snip_html}'
                         f'{note_html}{tags_html}'
@@ -276,7 +276,7 @@ def handle_search(query):
                 items = ""
                 for l in trusted:
                     items += (
-                        f'<li><a href="{esc(l["url"])}">{esc(l["label"])}</a> '
+                        f'<li><a href="{esc(clean_url(l["url"]))}" rel="noreferrer noopener">{esc(l["label"])}</a> '
                         f'<small>— from {esc(l["source_title"])}</small></li>'
                     )
                 trusted_html = (
@@ -311,8 +311,8 @@ def handle_search(query):
                 for r in items:
                     note_html = f' — <em>{esc(r["note"])}</em>' if r["note"] else ""
                     source_items += (
-                        f'<li><a href="{esc(r["url"])}">{esc(r["title"])}</a>'
-                        f'{note_html} <small>({esc(r["url"])})</small></li>'
+                        f'<li><a href="{esc(clean_url(r["url"]))}" rel="noreferrer noopener">{esc(r["title"])}</a>'
+                        f'{note_html} <small>({esc(clean_url(r["url"]))})</small></li>'
                     )
                 remote_html += (
                     f'<details class="remote" open>'
@@ -473,7 +473,7 @@ def handle_add_manual_submit(body):
                 # Log error but don't fail the whole operation
                 print(f"Error generating embeddings: {e}")
 
-        return handle_add_form(f'Added manually: <a href="{esc(url)}">{esc(manual_title)}</a>')
+        return handle_add_form(f'Added manually: <a href="{esc(url)}" rel="noreferrer noopener">{esc(manual_title)}</a>')
     finally:
         return_db(db)
 
@@ -500,7 +500,7 @@ def handle_pages(query=None):
                 tags_html = f' {tag_links}'
             items += (
                 f'<li>{esc(r["title"])}{note_html}{tags_html} '
-                f'<small>(<a href="{esc(r["url"])}">{esc(r["url"])}</a>)</small> '
+                f'<small>(<a href="{esc(r["url"])}" rel="noreferrer noopener">{esc(r["url"])}</a>)</small> '
                 f'<a href="/edit/{r["id"]}">edit</a> '
                 f'<a href="/delete/{r["id"]}">remove</a></li>'
             )
@@ -700,7 +700,7 @@ def handle_style_form(msg=""):
         f"<small>Default: reticulum.derickphan.com:4242</small><br>"
         f'<input name="transport_host" value="{esc(transport_host)}" placeholder="hostname" size="30">'
         f' <input name="transport_port" value="{esc(transport_port)}" placeholder="port" size="6"><br>'
-        f'<p><a href="https://rmap.world/" target="_blank">discover more nodes</a></p><br>'
+        f'<p><a href="https://rmap.world/" target="_blank" rel="noreferrer noopener">discover more nodes</a></p><br>'
         f"<h2>search</h2>"
         f"<h3>ai</h3>"
         f'<label><input type="checkbox" name="semantic_search" value="1"{semantic_checked} '
@@ -851,7 +851,7 @@ def handle_tag_browse(tag_name, query=None):
             tag_links = " ".join(f'<a href="/tags/{esc(t)}">[{esc(t)}]</a>' for t in tags)
             items += (
                 f'<li>{esc(r["title"])}{note_html} {tag_links} '
-                f'<small>(<a href="{esc(r["url"])}">{esc(r["url"])}</a>)</small></li>'
+                f'<small>(<a href="{esc(r["url"])}" rel="noreferrer noopener">{esc(r["url"])}</a>)</small></li>'
             )
     finally:
         return_db(db)
@@ -1397,8 +1397,7 @@ def dispatch_request(data):
         resp["headers"]["Content-Security-Policy"] = (
             "default-src 'self'; "
             "script-src 'self' 'unsafe-inline'; "
-            "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; "
-            "font-src 'self' https://fonts.gstatic.com; "
+            "style-src 'self' 'unsafe-inline'; "
             "img-src * data:; "
             "frame-ancestors 'none'; "
             "form-action 'self'; "