Server 2.6.1: code field upper-cases and inserts the dash

The phone pages' code field gets one inline script, allowed by its
SHA-256 hash in the CSP; a test checks the served script against the
header. Image pinned by digest in k8s/server.yaml (not applied).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QLJfZQZeAKAwSqViTmLzki

server/pairing_test.go

@@ -329,3 +329,30 @@ func TestClientAddressTakesTheProxysEntry(t *testing.T) {
 		t.Fatalf("without a proxy: %q", got)
 	}
 }
+
+// The typed-code field's script is the only one the pages may run: the CSP pins it by hash, so
+// the script served must hash to exactly what the header allows.
+func TestCodeScriptMatchesTheCSP(t *testing.T) {
+	api, _ := newTestAPI()
+	h := api.Routes()
+	script := regexp.MustCompile(`(?s)<script>(.*?)</script>`)
+	for _, path := range []string{"/pair", "/settings"} {
+		page := do(t, h, "GET", path, "", "")
+		if page.Code != 200 {
+			t.Fatalf("%s: %d", path, page.Code)
+		}
+		m := script.FindAllStringSubmatch(page.Body.String(), -1)
+		if len(m) != 1 || m[0][1] != codeScript {
+			t.Fatalf("%s: scripts %q", path, m)
+		}
+		csp := page.Header().Get("Content-Security-Policy")
+		if !strings.Contains(csp, "script-src 'sha256-"+scriptHash(m[0][1])+"'") || !strings.Contains(csp, "default-src 'none'") {
+			t.Fatalf("%s: CSP %q", path, csp)
+		}
+	}
+	// With the code in the link there is nothing to type, and no script.
+	_, userCode, _ := startPairing(t, h)
+	if body := do(t, h, "GET", "/pair?code="+userCode, "", "").Body.String(); strings.Contains(body, "<script") {
+		t.Fatal("script on the page with the code filled in")
+	}
+}