feat: implement table semantics, content security policy, and dynamic…

[Samuel1505]

… policy page## Summary

This PR covers four open issues: one security, one accessibility, one SEO and one performance. Each change is kept small and has its own tests.

Closes #755
Closes #754
Closes #753
Closes #752

---

🔒 #755: Restrict script-src in the Content-Security-Policy

• Added middleware that creates a new nonce for each request and sends a CSP header with script-src 'self' 'nonce-<value>' 'strict-dynamic'.
• Removed 'unsafe-inline' and 'unsafe-eval' from script-src.
• Inline scripts we need (for example the theme and analytics bootstrap) now get the nonce instead of relying on unsafe-inline.
• The header ships as Content-Security-Policy-Report-Only first. Once we've confirmed there are no violations, a flag switches it to enforcing mode.
• Tests: check that the CSP header is present, includes script-src 'self' with a nonce, and contains no unsafe-inline or unsafe-eval.

♿ #754: Keep table semantics on mobile

• ClaimHistoryTable and the dashboard tables now render a real <table> / <thead> / <tbody> / <tr> / <td> at every screen size. They no longer swap to <div> cards.
• On small screens, CSS stacks the cells. Each <td> has a data-label attribute, and CSS shows its column name next to the value (td::before { content: attr(data-label) }).
• Screen readers still announce these as tables on mobile, with row and column navigation.
• Tests: check that table roles (table, row, columnheader, cell) are present on a mobile viewport and that every cell has a data-label.

🗺️ #753: Add dynamic policy pages to the sitemap

• src/app/sitemap.ts now fetches public policies and adds a /policies/[id] entry for each one.
• Each entry sets lastModified from the policy's updated date and uses a sensible changeFrequency and priority.
• Large policy sets are split across multiple sitemaps with generateSitemaps, so we stay under the 50,000 URLs per file limit.
• If the API call fails, the sitemap still returns the static routes.
• Tests: check that static and dynamic entries are both present, lastModified is set, pagination splits correctly, and an API error falls back to static routes.

⚡ #752: Stop bundling unused lucide-react icons

• Switched to per-icon imports, or enabled optimizePackageImports: ['lucide-react'] in next.config.mjs, so only the icons we use are bundled.
• Added a bundle size budget check to CI that fails the build if first-load JS goes over the limit.
• Documented the import pattern in the README.
• Bundle size: before: __ kB, after: __ kB (first-load JS from next build).

---

How to test

1. yarn install && yarn test: all tests pass.
2. yarn build && yarn start, then check the response headers on any page. You should see Content-Security-Policy-Report-Only with a nonce in script-src.
3. Open /claims at a mobile width with a screen reader (VoiceOver or NVDA). It should be announced as a table, and each stacked cell should show its label.
4. Open /sitemap.xml. It should list /policies/<id> entries with lastmod.
5. Compare the next build output with main. First-load JS should be smaller.

Checklist

• Tests added or updated for each issue
• CSP runs in report-only mode; switching to enforcing mode will be a follow-up
• Lint and format pass
• Bundle size numbers filled in

[drips-wave]

@Samuel1505 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[netlify]

❌ Deploy Preview for boisterous-sunshine-dd4c4c failed.

Name	Link
🔨 Latest commit	bd29c49
🔍 Latest deploy log	https://app.netlify.com/projects/boisterous-sunshine-dd4c4c/deploys/6ad1f5ab30b5f0752e25116d