CSP missing opencode.ai connect-src and missing cache headers for proxied assets; file watcher causes HTTP bursts

Problem\n\n1. The CSP header in the server's catch-all route does not include in , blocking the changelog fetch.\n2. Proxied assets from lack headers, causing re-download on every page load.\n3. The file watcher calls and synchronously for each event, leading to bursts of HTTP requests when an agent writes many files rapidly.\n\n## Solution\n\n- Add to in CSP.\n- Add headers: for hashed assets under ; fallback for other proxied responses.\n- Implement a 150ms debounced batcher for file watcher invalidations.\n- Update watcher tests to use Bun's fake timers.\n\n## Testing\n\n- Built binary and verified changelog loads.\n- Checked DevTools → Network for new CSP directive and cache headers.\n- All watcher tests pass.\n\n## Checklist\n\n- [x] Code compiles and builds successfully.\n- [x] Binary runs and passes existing test suite.\n- [x] Changelog fetch works (CSP fix verified).\n- [x] Cache‑Control headers present as described.\n- [x] Debounced watcher reduces request bursts (observable in DevTools or netstat).\n- [x] No breaking changes to public APIs.\n

This issue doesn't fully meet our contributing guidelines.

What needs to be fixed:

No issue template was used. Please use one of the three required templates: Bug Report, Feature Request, or Question.
The current format (Problem/Solution/Testing/Checklist) matches a pull request description rather than an issue. If you have already implemented fixes, please open a pull request instead.
If this is a bug report, use the Bug Report template and include a Description field with reproduction steps and context.

Please edit this issue to address the above within 2 hours, or it will be automatically closed.

This issue might be a duplicate of existing issues. Please check:

opencode web tries to load changelog causing CORS errors. #17604: opencode web tries to load changelog causing CORS errors — overlaps with the CSP/changelog fetch fix described here.

If you believe this was flagged incorrectly, please let a maintainer know.

This issue has been automatically closed because it was not updated to meet our contributing guidelines within the 2-hour window.

Feel free to open a new issue that follows our issue templates.