fix: harden token and URL handling

* fix: harden token and URL handling

* test: restore full web test suite

---------

Co-authored-by: batumilove <batumilove@users.noreply.github.com>

packages/desktop/src-tauri/capabilities/default.json

@@ -8,8 +8,10 @@
 		{
 			"identifier": "http:default",
 			"allow": [
-				{ "url": "http://*" },
-				{ "url": "http://*:*" },
+				{ "url": "http://localhost" },
+				{ "url": "http://localhost:*" },
+				{ "url": "http://127.0.0.1" },
+				{ "url": "http://127.0.0.1:*" },
 				{ "url": "https://*" },
 				{ "url": "https://*:*" }
 			]

packages/desktop/src-tauri/tauri.conf.json

@@ -30,7 +30,7 @@
 			}
 		],
 		"security": {
-			"csp": null
+			"csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self' http://localhost:* http://127.0.0.1:* https:; object-src 'none'; base-uri 'none'; frame-ancestors 'none'"
 		}
 	},
 	"plugins": {