fix: production CSP blocking PostHog/Sentry/Scalar and silent failure hardening

The production CSP had connect-src/script-src/font-src set to 'self' only,
silently blocking all analytics and error reporting in production while
working fine in dev (where CSP is not applied).

CSP fixes:
- Add PostHog ingest + assets origins to connect-src and script-src
- Add Sentry ingest origin to connect-src
- Add Scalar fonts origin to font-src for API docs pages
- Extract CSP construction into testable buildCsp() function

Silent failure hardening:
- Settings/features stores now set loadError flag and allow retry on
  subsequent fetch() calls instead of permanently caching failed state
- Analytics init no longer sets initialized=true before the try block,
  allowing retry on failure
- Settings dialog Tools section disables save button when settings
  failed to load, preventing accidental config wipe
- Branding logo storage moved from process.cwd() to FILES_STORAGE_PATH
  so logos persist across Docker container recreation

Test coverage:
- 16 CSP directive tests covering all external service domains
- Store retry-on-error behavior tests for settings and features stores
- Analytics init retry-after-failure test

apps/web/src/components/settings/settings-dialog.tsx

@@ -2292,6 +2292,7 @@ function AuditLogSection() {
 function ToolsSection() {
   const [disabledTools, setDisabledTools] = useState<string[]>([]);
   const [loading, setLoading] = useState(true);
+  const [loadFailed, setLoadFailed] = useState(false);
   const [saving, setSaving] = useState(false);
   const [search, setSearch] = useState("");
   const [showRestartBanner, setShowRestartBanner] = useState(false);
@@ -2302,8 +2303,9 @@ function ToolsSection() {
         setDisabledTools(
           data.settings.disabledTools ? JSON.parse(data.settings.disabledTools) : [],
         );
+        setLoadFailed(false);
       })
-      .catch(() => {})
+      .catch(() => setLoadFailed(true))
       .finally(() => setLoading(false));
   }, []);
 
@@ -2424,11 +2426,17 @@ function ToolsSection() {
         </p>
       )}
 
+      {loadFailed && (
+        <div className="px-4 py-3 rounded-lg border border-red-500/30 bg-red-500/10 text-sm text-red-700 dark:text-red-400">
+          Failed to load tool settings. Saving is disabled to prevent data loss.
+        </div>
+      )}
+
       <div className="flex items-center gap-3 pt-2">
         <button
           type="button"
           onClick={handleSave}
-          disabled={saving}
+          disabled={saving || loadFailed}
           className="flex items-center gap-2 px-4 py-2 rounded-lg bg-primary text-primary-foreground text-sm font-medium hover:bg-primary/90 transition-colors disabled:opacity-50"
         >
           {saving && <Loader2 className="h-3.5 w-3.5 animate-spin" />}

apps/web/src/lib/analytics.ts

@@ -16,12 +16,10 @@ function scrubString(str: string): string {
 
 export async function initAnalytics(config: AnalyticsConfig): Promise<void> {
   if (initialized || !config.enabled) return;
-  initialized = true;
 
   try {
     const posthogJs = (await import("posthog-js")).default;
     if (!consentGranted) {
-      initialized = false;
       return;
     }
     posthog =
@@ -39,15 +37,15 @@ export async function initAnalytics(config: AnalyticsConfig): Promise<void> {
         ip: false,
         persistence: "localStorage",
       }) ?? null;
-  } catch {
-    // SDK blocked or unavailable
+    initialized = true;
+  } catch (err) {
+    console.warn("[analytics] PostHog init failed:", err);
   }
 
   try {
     if (config.sentryDsn) {
       const Sentry = await import("@sentry/react");
       if (!consentGranted) {
-        initialized = false;
         return;
       }
       Sentry.init({
@@ -86,8 +84,8 @@ export async function initAnalytics(config: AnalyticsConfig): Promise<void> {
         },
       });
     }
-  } catch {
-    // Sentry blocked or unavailable
+  } catch (err) {
+    console.warn("[analytics] Sentry init failed:", err);
   }
 }
 

apps/web/src/stores/features-store.ts

@@ -11,6 +11,7 @@ interface BundleProgress {
 interface FeaturesState {
   bundles: FeatureBundleState[];
   loaded: boolean;
+  loadError: boolean;
   installing: Record<string, BundleProgress>;
   errors: Record<string, string>;
   queued: string[];
@@ -149,6 +150,7 @@ export const useFeaturesStore = create<FeaturesState>((set, get) => {
   return {
     bundles: [],
     loaded: false,
+    loadError: false,
     installing: {},
     errors: {},
     queued: [],
@@ -156,13 +158,13 @@ export const useFeaturesStore = create<FeaturesState>((set, get) => {
     startTimes: {},
 
     fetch: async () => {
-      if (get().loaded) return;
+      if (get().loaded && !get().loadError) return;
       try {
         const data = await apiGet<{ bundles: FeatureBundleState[] }>("/v1/features");
-        set({ bundles: data.bundles, loaded: true });
+        set({ bundles: data.bundles, loaded: true, loadError: false });
         recoverActiveInstalls();
       } catch {
-        set({ loaded: true });
+        set({ loaded: true, loadError: true });
       }
     },
 

apps/web/src/stores/settings-store.ts

@@ -10,6 +10,7 @@ interface SettingsState {
   defaultToolView: "sidebar" | "fullscreen";
   defaultTheme: Theme;
   loaded: boolean;
+  loadError: boolean;
   fetch: () => Promise<void>;
 }
 
@@ -21,9 +22,10 @@ export const useSettingsStore = create<SettingsState>((set, get) => ({
   defaultToolView: "sidebar",
   defaultTheme: "light",
   loaded: false,
+  loadError: false,
 
   fetch: async () => {
-    if (get().loaded) return;
+    if (get().loaded && !get().loadError) return;
     try {
       const data = await apiGet<{
         settings: Record<string, string>;
@@ -39,11 +41,12 @@ export const useSettingsStore = create<SettingsState>((set, get) => ({
         defaultToolView: data.settings.defaultToolView === "fullscreen" ? "fullscreen" : "sidebar",
         defaultTheme,
         loaded: true,
+        loadError: false,
       });
 
       useThemeStore.getState().applyServerDefault(defaultTheme);
     } catch {
-      set({ loaded: true });
+      set({ loaded: true, loadError: true });
     }
   },
 }));