chore(deploy): Amplify CSP for the server-tiles app (no wasm)

Custom response headers for the static deploy: a CSP that allows the app's own
modules, the OSM basemap, and NOAA connections — without the retired wasm baker's
'wasm-unsafe-eval'/worker-src — plus immutable caching for .pmtiles.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: beetlebugorg

web/customHttp.yml

@@ -0,0 +1,20 @@
+# AWS Amplify custom response headers (overrides Amplify's default managed CSP,
+# which sets script-src-elem 'none' and blocks the app's own modules).
+# Place at the ROOT of the deployed artifact (same dir as index.html). Tiles are
+# baked server-side now (no in-browser wasm), so the CSP no longer needs
+# 'wasm-unsafe-eval' or worker-src.
+customHeaders:
+  - pattern: '**'
+    headers:
+      - key: 'Content-Security-Policy'
+        value: "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https://tile.openstreetmap.org; media-src 'self' data: blob:; connect-src 'self' blob: data: https://www.charts.noaa.gov https://tile.openstreetmap.org; font-src 'self'; object-src 'none'; base-uri 'self'"
+
+  # PMTiles archives: long-lived immutable content (content is versioned by a
+  # re-bake), and must be byte-range readable — Amplify/CloudFront honour Range
+  # for these by default; just don't let anything gzip-encode them.
+  - pattern: '**/*.pmtiles'
+    headers:
+      - key: 'Cache-Control'
+        value: 'public, max-age=31536000, immutable'
+      - key: 'Content-Type'
+        value: 'application/octet-stream'