fix: resolve 3 security audit issues

#3: Stored XSS in stats dashboard - escape p[path] with html.escape()
#4: Caddy timeout race - increase read/write_timeout 30s -> 60s
#5: Missing CSP header - add Content-Security-Policy to Caddyfile

url_rewriter.py

@@ -83,6 +83,30 @@ def rewrite_response_headers(headers: dict) -> dict:
     return new_headers
 
 
+def rewrite_response_headers_raw(headers_raw: list) -> list:
+    """Rewrite AO3 domains in raw response headers (preserves multi-value Set-Cookie).
+
+    Unlike rewrite_response_headers which works on a dict (collapsing multi-value
+    Set-Cookie), this operates on a list of (key, value) tuples so ALL Set-Cookie
+    values are preserved and individually rewritten.
+    """
+    result = []
+    for key, value in headers_raw:
+        key_lower = key.lower()
+
+        if key_lower == "location":
+            value = value.replace(TARGET_DOMAIN, MIRROR_DOMAIN)
+            value = value.replace("http://", "https://")
+
+        elif key_lower == "set-cookie":
+            value = value.replace(f"domain={TARGET_DOMAIN}", f"domain={MIRROR_DOMAIN}")
+            value = value.replace(f"Domain={TARGET_DOMAIN}", f"Domain={MIRROR_DOMAIN}")
+
+        result.append((key, value))
+
+    return result
+
+
 def rewrite_redirect_url(url: str) -> str:
     """Rewrite AO3 URLs in redirect targets."""
     return url.replace(TARGET_DOMAIN, MIRROR_DOMAIN).replace("http://", "https://")