feat(electron): harden renderer security

Scope playback request header overrides to active stream origins and document the Electron runtime security contract.

apps/web/src/index.html

@@ -6,6 +6,10 @@
         <base href="/" />
 
         <meta name="viewport" content="width=device-width, initial-scale=1" />
+        <meta
+            http-equiv="Content-Security-Policy"
+            content="default-src 'self'; base-uri 'self'; object-src 'none'; frame-src 'none'; form-action 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' http: https: file: data: blob:; font-src 'self' data:; media-src 'self' http: https: file: data: blob:; connect-src 'self' http: https: ws: wss: blob: data:; worker-src 'self' blob:"
+        />
         <meta property="og:type" content="website" />
         <meta property="og:title" content="IPTVnator" />
         <meta property="og:url" content="https://iptvnator.vercel.app" />

apps/web/src/typings.d.ts

@@ -67,7 +67,11 @@ declare global {
                 filePath: string,
                 content: string
             ) => Promise<{ success: boolean }>;
-            setUserAgent: (userAgent: string, referer?: string) => void;
+            setUserAgent: (
+                userAgent?: string | null,
+                referer?: string | null,
+                scopeUrl?: string | null
+            ) => Promise<boolean>;
             openInMpv: (
                 url: string,
                 title: string,