Red-team hardening: CSP, SEO/OG, a11y, esc() quotes, doc reconciliation

[holoros]

Implements the actionable items from the 2 July 2026 red-team review (docs/active-projects handoff).

Security

• Add a Content-Security-Policy meta tag: blocks inline/external/eval scripts; allows same-origin plus ipapi.co for the geolocation fallback. Verified the built bundle has no inline scripts, no eval/Function, and only ipapi.co as a cross-origin connect.
• Harden esc() in report.js, myForest.js, RunBuilder.jsx to also escape " and ' (defense-in-depth for the document.write report path).
• Disclose the ipapi.co IP fallback in the 'Forest near me' control tooltip.

Docs (M2: reconcile with reality)

• SECURITY.md: correct the same-origin claim (now discloses ipapi) and update 'Supported versions' to continuous deploy from main.
• CONTRIBUTING.md: retire the stale v0.73/v1.3 source-vs-deploy section; describe the actual push-to-main auto-deploy.

Website

• SEO: meta description, canonical, theme-color; Open Graph + Twitter cards (og:image = logos/perseus.png).
• Add robots.txt, sitemap.xml, and a redirecting 404.html.
• Loading state in #root before React hydrates.

Accessibility

• Raise sub-11px control labels and lift muted text off #5e7180 (WCAG AA contrast fail at small sizes) to new --mut2; nudge --mut lighter.

CI

• build-check.yml now runs check_api_integrity.py --strict as a gate (passes on current data) and sets up Python.

Verified: npm run build succeeds; strict integrity check passes (50 states, 46 metrics, 0 structural issues).