feat: harden end-to-end simulation workflow

scripts/serve.ps1

@@ -42,7 +42,15 @@ function Send-TextResponse {
 }
 
 try {
-    $listener.Start()
+    try {
+        $listener.Start()
+    }
+    catch [System.Net.HttpListenerException] {
+        throw [System.InvalidOperationException]::new(
+            "Port $Port is unavailable. Close the running micarrsim window or choose another port, for example: start.cmd -Port 4174",
+            $_.Exception
+        )
+    }
     Write-Host "micarrsim is running at $serverUrl" -ForegroundColor Green
     Write-Host 'Press Ctrl+C to stop.' -ForegroundColor DarkGray
 
@@ -54,11 +62,26 @@ try {
         $context = $listener.GetContext()
 
         try {
+            $context.Response.Headers['Content-Security-Policy'] = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' blob: data:; media-src 'self' blob:; worker-src 'self'; connect-src 'self' blob:; object-src 'none'; base-uri 'none'; frame-ancestors 'self'; form-action 'none'"
+            $context.Response.Headers['Referrer-Policy'] = 'no-referrer'
+            $context.Response.Headers['X-Content-Type-Options'] = 'nosniff'
+
+            if ($context.Request.HttpMethod -notin @('GET', 'HEAD')) {
+                $context.Response.Headers['Allow'] = 'GET, HEAD'
+                Send-TextResponse -Response $context.Response -StatusCode 405 -Message 'Method not allowed'
+                continue
+            }
+
             $relativePath = [System.Uri]::UnescapeDataString($context.Request.Url.AbsolutePath.TrimStart('/'))
             $relativePath = $relativePath.Replace('/', [System.IO.Path]::DirectorySeparatorChar)
             if ([string]::IsNullOrWhiteSpace($relativePath)) {
                 $relativePath = 'index.html'
             }
+            $pathSegments = $relativePath -split '[\\/]'
+            if ($pathSegments | Where-Object { $_.StartsWith('.') }) {
+                Send-TextResponse -Response $context.Response -StatusCode 403 -Message 'Forbidden'
+                continue
+            }
 
             $candidatePath = [System.IO.Path]::GetFullPath((Join-Path $projectRoot $relativePath))
             $isWithinRoot = $candidatePath.Equals($projectRoot, [System.StringComparison]::OrdinalIgnoreCase) -or