Add CSP header and session rotation on login

Content-Security-Policy: default-src 'self'; restricts external resource loading. Session rotation: delete all existing sessions for a user on login, so re-logging invalidates any leaked tokens.

api.php

@@ -14,6 +14,7 @@ set_exception_handler(function($e) use ($logFile) {
 
 header('Content-Type: application/json');
 header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
+header("Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; connect-src 'self'; img-src 'self' data:; font-src 'self'; form-action 'self'; frame-ancestors 'none'; base-uri 'self'; object-src 'none'");
 
 $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
 if ($origin && preg_match('#^https?://(localhost|127\.0\.0\.1)(:\d+)?$#', $origin)) {
@@ -297,6 +298,9 @@ try {
                 $upd->execute();
             }
             clearAttempts($db);
+            $delSessions = $db->prepare('DELETE FROM sessions WHERE user_id=:uid');
+            $delSessions->bindValue(':uid', $user['id'], SQLITE3_INTEGER);
+            $delSessions->execute();
             $defaultFolders = ['All', 'Social', 'Banking', 'Work', 'Personal'];
             $stFolder = $db->prepare('INSERT OR IGNORE INTO folders (user_id, name) VALUES (:uid, :name)');
             foreach ($defaultFolders as $name) {