Modernize frontend assets and security baseline

docs/SECURITY.md

@@ -0,0 +1,37 @@
+# Site security policy
+
+The generated HTML includes a baseline Content Security Policy and referrer
+policy so browsers receive protection even before an edge rule is installed.
+The production edge must also set the following HTTP response headers for
+`familyfed.ie`:
+
+```text
+Content-Security-Policy: default-src 'self'; base-uri 'self'; object-src 'none'; frame-ancestors 'none'; img-src 'self' data: https:; font-src 'self' data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://static.cloudflareinsights.com; connect-src 'self' https:; frame-src https://www.youtube.com https://www.youtube-nocookie.com https://player.vimeo.com; form-action 'self' mailto: https:; upgrade-insecure-requests
+Cross-Origin-Opener-Policy: same-origin
+Cross-Origin-Resource-Policy: same-site
+Permissions-Policy: camera=(), geolocation=(), microphone=(), payment=(), usb=()
+Referrer-Policy: strict-origin-when-cross-origin
+Strict-Transport-Security: max-age=63072000; includeSubDomains
+X-Content-Type-Options: nosniff
+X-Frame-Options: DENY
+```
+
+The rule must be scoped to `http.host eq "familyfed.ie"`. If Plausible is
+enabled on a non-default host, add that exact origin to `script-src`.
+
+## Origin access
+
+The public website virtual host must accept HTTP/HTTPS traffic only from
+Cloudflare's published IPv4 and IPv6 ranges. Keep the S3 deployment API on
+`s3-sites.bcgen.ie` reachable by Forgejo runners; do not apply the website
+virtual-host restriction to the S3 API listener. Authenticated Origin Pulls or
+a Cloudflare Tunnel are preferable when supported by the origin proxy.
+
+Verify the restriction from a non-Cloudflare client with:
+
+```bash
+curl --resolve familyfed.ie:443:ORIGIN_IP https://familyfed.ie/
+```
+
+The request must fail before an HTTP response is served, while the normal
+`https://familyfed.ie/` request must continue to succeed through Cloudflare.

docs/SITE-STRUCTURE.md

@@ -66,7 +66,7 @@ inside the file so formatting is preserved while metadata becomes frontmatter.
 - `css/block-library.css` - WordPress block styles used by the pages
 - `css/theme.css` - CSS extracted from the repeated Parabola inline export
 - `css/site.css` - shared site fixes, shortcode rule, and homepage slider/frontpage CSS
-- `js/jquery.min.js` - shared jQuery dependency used by the pages
+- `js/site.js` - dependency-free navigation, back-to-top, and responsive-video behavior
 - `assets/theme/` - exported theme styles, scripts, fonts, and images
 - `assets/vendor/` - exported third-party plugin/vendor assets
 - `assets/uploads/` - uploaded images and PDFs used by content pages