feat: self-hosted frontend JS (offline) + docker hardening

- Vendored epub.js/pdf.js+worker/JSZip/DOMPurify in static/vendor/
- reader.html/reader.js servono i JS da /static (niente CDN, offline-ready)
- CSP: rimosse allowlist CDN, aggiunto worker-src 'self' blob:
- Test CSP aggiornati; tutti 16 verdi; verificato smoke test offline in container

.github/workflows/ci.yml

@@ -0,0 +1,94 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    name: pytest (3.12)
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install deps (lock)
+        run: |
+          python -m venv .venv
+          .venv/bin/pip install --upgrade pip
+          .venv/bin/pip install -r requirements.lock pytest
+
+      - name: Run tests
+        run: |
+          .venv/bin/python -m pytest tests/ -v
+
+  docker:
+    runs-on: ubuntu-latest
+    needs: test
+    name: Docker smoke test
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Prepare env
+        run: |
+          cp .env.example .env
+          # secret di prova per il container (DEBUG=false in Docker)
+          sed -i 's/^BOOKISH_SECRET=.*/BOOKISH_SECRET=ci-test-secret-long-enough/' .env
+
+      - name: Build image
+        run: docker compose build
+
+      - name: Start stack
+        run: docker compose up -d
+
+      - name: Wait for health
+        run: |
+          for i in $(seq 1 30); do
+            if curl -sf http://127.0.0.1:5000/healthz >/dev/null; then
+              echo "healthz OK dopo ${i} tentativi"
+              exit 0
+            fi
+            sleep 2
+          done
+          echo "healthz non risponde"
+          docker compose logs bookish
+          exit 1
+
+      - name: Smoke: upload epub -> epub (conversione, SSE)
+        run: |
+          # finto epub (zip minimo vuoto accettato per estensione; la conversione
+          # può fallire per formato, ma l'upload deve tornare 200 con task_id)
+          printf 'PK\x03\x04 x' > /tmp/sample.epub
+          RESP=$(curl -s -F "file=@/tmp/sample.epub" -F "output_format=epub" http://127.0.0.1:5000/upload)
+          echo "$RESP"
+          echo "$RESP" | grep -q '"task_id"' || { echo "task_id mancante"; exit 1; }
+
+      - name: Smoke: CSP header presente
+        run: |
+          curl -sI http://127.0.0.1:5000/ | grep -q "Content-Security-Policy" || { echo "CSP assente"; exit 1; }
+
+      - name: Smoke: auth opzionale funziona (override)
+        run: |
+          cat > /tmp/override.yml << 'EOF'
+          services:
+            bookish:
+              environment:
+                BOOKISH_AUTH_USERNAME: ci
+                BOOKISH_AUTH_PASSWORD: ci-pass
+          EOF
+          docker compose -f docker-compose.yml -f /tmp/override.yml up -d
+          sleep 6
+          CODE=$(curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:5000/)
+          [ "$CODE" = "401" ] || { echo "atteso 401, ottenuto $CODE"; exit 1; }
+          CODE=$(curl -s -o /dev/null -w "%{http_code}" -u ci:ci-pass http://127.0.0.1:5000/)
+          [ "$CODE" = "200" ] || { echo "atteso 200 con credenziali, ottenuto $CODE"; exit 1; }
+          echo "auth OK"
+          docker compose up -d   # torna al default (senza auth)
+
+      - name: Cleanup
+        if: always()
+        run: docker compose down --remove-orphans --volumes