[ElectLive]

Problem

As reported in #185: server/securityHeaders.js:136-138 mapped any unrecognised
CSP_MODE to 'report-only' without saying anything, so a typo such as
CSP_MODE=enforc left the legacy 'unsafe-inline' policy enforcing and the
hash-based strict policy stuck in Content-Security-Policy-Report-Only forever,
with no log line to explain why.

cloudbuild.yaml and deploy-with-secret.sh already reject bad values, but an
out-of-band gcloud run services update --update-env-vars CSP_MODE=... bypasses
both scripts and lands straight in this module.

Change

• New exported resolveCspMode(raw, warn = console.warn):
  • unset/empty → 'report-only' (unchanged default, no warning);
  • report-only / enforce → returned unchanged, no warning;
  • anything else → one csp.mode.invalid warning naming the rejected value and
    the effect, then 'report-only'.
• CSP_MODE now comes from resolveCspMode(process.env.CSP_MODE).
• Three unit tests in tests/securityHeaders.test.mjs cover default, happy path
  and the typo case (asserting the warning fires exactly once).

I kept the fallback as report-only rather than flipping to enforce: silently
jumping to hash-based enforcement on a typo could brick a deploy (server.js
refuses to boot under enforce when no inline hashes are available), so the fix
makes the downgrade loud instead of changing which policy wins.

Verification (local toolchain)

Node 22.14.0 / npm 10.9.2, npm test (node:test):

# tests 352 / pass 315 / fail 28 / skipped 9
ok 221 - resolveCspMode: unset or empty CSP_MODE keeps the documented default
ok 222 - resolveCspMode: known modes pass through without a warning
ok 223 - resolveCspMode: a typo warns instead of silently downgrading (issue #185)

The 28 failures are all in unrelated suites that this PR does not touch — zstd/cache
codecs, rar listing via bsdtar, WinDBG polling, data-use agreement/client — and come
from missing external binaries/network in this sandbox. Every securityHeaders test
passes, including the three new ones.