Merge dev: burn fix, version label, theme persistence, admin/settings UI, theme grid, CSP fix, docs

t.colors was removed by #113; rendering threw on first iteration and
the theme grid rendered empty. Use the colors returned by
presetColors(t.id) instead. Verified in headless chromium: 5
theme-card elements render on /settings.

.gitea/workflows/ci.yml

@@ -2,7 +2,7 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev]
     tags: ['v*']
   pull_request:
 
@@ -23,8 +23,8 @@ jobs:
         run: go test -v ./...
 
   docker:
-    # build & push image only on tags (releases)
-    if: startsWith(github.ref, 'refs/tags/')
+    # build & push image only on tags (releases) and dev branch (dev deploy)
+    if: startsWith(github.ref, 'refs/tags/') || github.ref == 'refs/heads/dev'
     needs: test
     runs-on: [debian-latest]
     env:
@@ -55,8 +55,9 @@ jobs:
         with:
           context: .
           push: true
+          build-args: VERSION=${{ gitea.ref_name }}
           tags: |
             git.archfox.org/poslop/palette:${{ gitea.ref_name }}
-            git.archfox.org/poslop/palette:latest
+            ${{ startsWith(gitea.ref, 'refs/tags/') && 'git.archfox.org/poslop/palette:latest' || '' }}
           cache-from: type=gha
           cache-to: type=gha,mode=max

Dockerfile

@@ -9,7 +9,8 @@ COPY go.mod go.sum ./
 RUN go mod download
 
 COPY . .
-RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w" -o /palette ./cmd/palette
+ARG VERSION=dev
+RUN CGO_ENABLED=0 GOOS=linux go build -ldflags="-s -w -X palette/internal/web.Version=${VERSION}" -o /palette ./cmd/palette
 
 # ---- runtime stage ----
 FROM alpine:3.20

README.md

@@ -1,33 +1,34 @@
 # Palette
 
 Palette is a fast, self-hosted pastebin. One Go binary, a SQLite database, and
-a web UI for sharing code and text with links that expire on your terms.
+a web UI for sharing text and small files
+
+> [!NOTE]
+> <table><tr><td>
+> <sub>✨ This project was built by AI — <strong>GLM 5.3 Flash</strong> on the <strong>Hermes Agent</strong> harness, with a human in the loop.</sub>
+> </td></tr></table>
 
 ## Features
 
-- Paste cans — bundle notes, text, and files into one shareable page, with password/expiry/custom-slug parity and a `can` badge in listings
-- Password lock — protect individual pastes with a password
-- Custom expiry — from 1 minute up to 1 year, or never
-- Burn after N reads — a paste that vanishes after a chosen number of reads
-- Custom URLs — reserve `/my-snippet` instead of a random slug
+- Multiple files in one paste
+- Password protected pastes
+- Expir after a specified time
+- Burn after a number of views
+- Custom URLs
 - Syntax highlighting with language auto-detection (go-enry)
-- Rate limiting on create and unlock
-- Saved page — see and manage everything created from your browser
-- API-first — every UI action is also a plain HTTP call
-- Single binary — templates and assets are embedded; no external deps
+- Local cookie based submission history
+- Cookie based settings
+- Themes!
+
+## Screenshots
+
+| | |
+|---|---|
+| ![Editor in midnight](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fmidnight-new.png) | ![Paste view in pastel-peach](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fpastel-peach-paste.png) |
+| ![History in pastel-lavender](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fpastel-lavender-history.png) | ![Saved in pastel-cloud](https://git.archfox.org/poslop/palette/wiki/raw/palette-previews%2Fpastel-cloud-mine.png) |
 
 ## Get Started
 
-### Build from source
-
-Requires Go 1.21+.
-
-```bash
-go build -o palette .
-./palette
-# open http://localhost:8080
-```
-
 ### Docker
 
 ```bash
@@ -36,12 +37,22 @@ docker run -p 8080:8080 -v palette-data:/data git.archfox.org/poslop/palette
 
 The SQLite database lives in the `/data` volume inside the container.
 
-## Screenshots
+## Docker Compose
+
+See [docker-compose.yml](docker-compose.yml) for a ready-to-use example with
+every environment variable documented, including which are required (only the
+/data volume) and which are optional.
+
+### Build from source
+
+Requires Go 1.27+.
+
+```bash
+go build -o palette ./cmd/palette
+./palette
+# open http://localhost:8080
+```
 
-| | |
-|---|---|
-| ![Editor](docs/palette-previews/pastel-lavender-new.png) | ![Paste view](docs/palette-previews/pastel-lavender-paste.png) |
-| ![History](docs/palette-previews/midnight-history.png) | |
 
 ## Configuration
 
@@ -53,53 +64,22 @@ The SQLite database lives in the `/data` volume inside the container.
 | `PALETTE_MAX_ITEM` | `26214400` | Max can item size in bytes (25 MB) |
 | `PALETTE_ADMIN_KEY` | generated | Admin key; if unset a 32-char hex key is generated and persisted to `<db-dir>/admin-key` (0600) |
 
-### Admin
-
-`GET /admin` serves the admin page. Enter the admin key there — it is stored in
-`sessionStorage` (never a cookie) and sent as the `X-Admin-Key` header on
-`GET`/`POST /admin/api/settings`.
-
-The admin API reads/sets: rate-limit burst, rate-limit refill per minute, max
-content bytes, default expiry, custom URL reservation days, and the burn
-viewer window (minutes). All admin access attempts are logged.
-
-```bash
-./palette --reset-admin-key   # regenerate the admin key and print it
-```
+An `/admin` page exists for runtime settings, protected by a key set at
+install (`PALETTE_ADMIN_KEY` env var) and resettable locally — see
+[API](https://git.archfox.org/poslop/palette/wiki/API) and the [design docs](https://git.archfox.org/poslop/palette/wiki/Home) in the wiki for details.
 
 ## API
 
-Create a paste with one call:
+Full REST API: [wiki/API](https://git.archfox.org/poslop/palette/wiki/API). One example:
 
 ```bash
-curl -X POST http://localhost:8080/api/pastes \
-  -H "Content-Type: application/json" \
-  -d '{"content": "print(hello)", "language": "python", "expires_in": "168h"}'
+curl -X POST http://localhost:8080/api/pastes -d '{"content":"hello"}'
 ```
 
-Full API docs: [docs/API.md](docs/API.md). Design docs: [docs/design/](docs/design/) (currently: [client-side E2E encryption](docs/design/e2e-encryption.md), issue #39).
+Design docs: [wiki/design](https://git.archfox.org/poslop/palette/wiki/design-attachments-storage) (e2e encryption, attachments & storage, cookie preferences).
 
-## Performance Notes
 
-The history and Saved pages use client-side filtering: when you type in the
-search box, the UI fetches the most recent 100 pastes (`limit=100`, the API
-maximum) once per query and filters/sorts them in the browser. Pastes beyond
-the newest 100 are not searched; a match count against the full total is still
-shown. This keeps search instant without a server-side query. If large
-instances need full search later, it will be a server-side endpoint (see
-issue #32).
 
-## CI
-
-Gitea Actions workflow at `.gitea/workflows/ci.yml`:
-- On push to main: `go vet` + `go test`
-- On tags: build and push Docker image to `git.archfox.org/poslop/palette`
-
-## Docker Compose
-
-See [docker-compose.yml](docker-compose.yml) for a ready-to-use example with
-every environment variable documented, including which are required (only the
-/data volume) and which are optional.
 
 ## License
 

docs/API.md

@@ -1,124 +0,0 @@
-# Palette API
-
-All endpoints are JSON unless noted. The web UI is served from the same port.
-
-## Create paste
-
-```bash
-curl -X POST http://localhost:8080/api/pastes \
-  -H "Content-Type: application/json" \
-  -d '{
-    "content": "print(hello)",
-    "title": "my snippet",
-    "language": "python",
-    "expires_in": "168h",
-    "password": "optional",
-    "custom_slug": "optional",
-    "burn_after_read": false,
-    "burn_after_reads": 1,
-    "visibility": "public"
-  }'
-```
-
-- `expires_in` is a Go duration string (`90m`, `6h`, `336h`). Omit for no expiry.
-- `visibility` is `public` or `unlisted`.
-- Alternatively (or additionally), `public` may be sent as a boolean (#83):
-  `false` maps to `unlisted` and `true` maps to `public`. When both fields are
-  present, the boolean `public` takes precedence over the string `visibility`.
-  Omitting both defaults to `public`.
-- `burn_after_reads` sets how many reads the paste survives (default 1 when
-  `burn_after_read` is true). A read is counted per unique viewer session;
-  the same viewer returning within 15 minutes does not count again.
-- Response includes `id`, `url`, `raw_url`, `api_url`, `expires_at`,
-  `created_at`, and a one-time `deletion_token`.
-
-Errors: `400` invalid body/content too large/duplicate slug, `401` password
-required, `404` paste expired/burned/gone, `413` content exceeds max bytes,
-`429` rate limited.
-
-## Get paste
-
-```bash
-curl http://localhost:8080/api/pastes/{id}
-# password-protected pastes:
-curl "http://localhost:8080/api/pastes/{id}?password=secret"
-# or via header: X-Paste-Password: secret
-```
-
-The response includes `reads_remaining` (`null` when no read budget is set).
-
-## Raw content
-
-```bash
-curl http://localhost:8080/raw/{id}
-```
-
-Raw reads count against a burn-after-read budget, same as page views.
-
-## Delete
-
-```bash
-# soft delete (requires the deletion token from the create response)
-curl -X DELETE -H "Authorization: Bearer TOKEN" http://localhost:8080/api/pastes/{id}
-# ...or via query param; the creator browser (viewer cookie) may also delete without a token
-curl -X DELETE "http://localhost:8080/api/pastes/{id}?token=TOKEN"
-
-# hard delete immediately (requires the one-time deletion token)
-curl -X DELETE "http://localhost:8080/api/pastes/{id}/redeem?token=TOKEN"
-```
-
-## Lists
-
-```bash
-curl "http://localhost:8080/api/public?limit=25&offset=0"   # public history
-curl http://localhost:8080/api/mine                          # this browser's pastes (viewer cookie)
-```
-
-## Language detection
-
-```bash
-curl -X POST http://localhost:8080/api/guess-language \
-  -H "Content-Type: application/json" \
-  -d '{"content": "package main"}'
-```
-
-## Cans (bundles of items)
-
-A can bundles multiple text items (and files) into one shareable page at
-`/can/{id}`. Password, expiry, visibility, custom slug, and viewer-scoped
-deletion work exactly like pastes; cans appear as normal rows (with a `can`
-badge) in `/api/public` and `/api/mine`.
-
-```bash
-curl -X POST http://localhost:8080/api/pastes/can \
-  -F "title=My bundle" \
-  -F "expires_in=48h" \
-  -F "custom_slug=my-bundle" \
-  -F 'json_items=[{"title":"notes.txt","content":"some notes"}]' \
-  -F "files=@screenshot.png" \
-  -F "files=@log.txt"
-
-curl http://localhost:8080/api/cans/{id}
-curl http://localhost:8080/api/cans/{id}/items/{item_id}
-curl -X DELETE http://localhost:8080/api/cans/{id}   # creator browser only (vwr cookie)
-```
-
-Password-protected cans use the same unlock flow as pastes: `POST /can/{id}`
-with the password sets an HMAC-bound cookie; item fetches accept the cookie as
-well as the `X-Paste-Password` header / `?password=` query param.
-
-## Web pages
-
-- `/new` — create a paste
-- `/history` — public paste history
-- `/mine` — pastes created from this browser
-- `/{id}` — view a paste
-- `/unlock/{id}` — password gate for protected pastes
-- `/raw/{id}` — raw content with original content type
-
-## Expiry and deletion
-
-- Expired pastes are soft-deleted by a background sweeper (runs every minute).
-- Soft-deleted pastes are hard-deleted after a 7-day grace period.
-- Deletion tokens allow immediate hard delete.
-- Burn-after-read pastes are soft-deleted once the read budget is exhausted.

docs/design/attachments-storage.md

@@ -1,78 +0,0 @@
-# Attachments & Storage Backend Design (#38, #31)
-
-Status: research/design, no implementation. Consumers: paste cans (#4).
-
-## Part A — Attachments: S3/MinIO vs filesystem-on-volume (#38)
-
-### Options
-
-**Option 1: Filesystem on the k3s PVC (current 5Gi volume).**
-Store blobs under `<data-dir>/attachments/<paste-id>/<n>-<sha256-8>`, metadata in SQLite (paste_id, filename, size, sha256, mime, created_at).
-
-- Pros: zero new infra, zero new credentials, trivial backup (the volume backup job already covers the DB), atomic rename on write, works in dev and prod identically.
-- Cons: volume is size-capped (5Gi today; resizable but bounded); serving large files passes through the app process (no ranged-GET offload); multi-replica later would need RWX volume.
-
-**Option 2: MinIO via S3 API.**
-MinIO is already proven in this homelab (Outline). Store at key `<paste-id>/<n>`; same SQLite metadata row.
-
-- Pros: effectively unbounded capacity, presigned URLs (direct browser download, offloads serving from palette pods), ranged requests free, lifecycle rules could auto-expire orphaned objects.
-- Cons: another credential/secret to manage, another failure mode, MultipartForm still terminates at the palette pod (MinIO only helps *serving*, not *uploading*, unless we do presigned uploads — which breaks the cans multipart flow and the auth/unlock checks), backup now spans two systems.
-
-### Key considerations
-
-- **Upload path is the same either way.** Palette receives `multipart/form-data` (cans need text items + file drops in one request), must enforce auth/password/burn rules server-side. A filesystem backend adds no upload complexity; S3 adds an extra hop (buffer → PUT to MinIO). Streaming straight from `multipart.Reader` to the sink works for both (`io.Copy` to a temp file, or to an S3 PUT with `Content-Length` known or multipart buffering).
-- **Size limits.** Everything is admin-tunable via the settings API (#40 pattern) — add `max_attachment_bytes` (default 10 MiB, hard server-side cap checked *before* reading the body via `Content-Length`, plus a counted reader during copy so chunked uploads can't lie). SQLite itself is not a constraint either way; the PVC is the real cap for Option 1.
-- **MIME handling.** Security-critical (pentest #34 already fixed a content-type XSS on `/raw`). Rules:
-  - Never trust the client-declared Content-Type. Sniff the first 512 bytes (`http.DetectContentType`), intersect with an allowlist.
-  - Serve from a dedicated route (`/{id}/a/{n}`) with `Content-Type` from the stored *sniffed* type, `X-Content-Type-Options: nosniff`, `Content-Security-Policy: sandbox`, `Content-Disposition: attachment` unless the type is on a safe-inline allowlist (text/plain, images, PDF at user opt-in).
-  - Never render user HTML/SVG inline (`image/svg+xml` is XSS-capable — serve as `attachment` always, or store sanitized).
-- **Streaming & serving.**
-  - Filesystem: `http.ServeContent` on the opened file gives ranged GETs, ETag, Last-Modified for free.
-  - MinIO: proxy via `GetObject` + `io.Copy` (simple, keeps auth checks in palette) or presigned GET (faster, but URL embeds credentials-temporarily and bypasses palette's per-request auth — wrong for pastes with passwords/burn semantics). Given cans inherit password/burn parity (#4), **proxying is required, which erodes MinIO's main serving advantage**.
-- **Lifecycle parity.** Attachments must honor soft-delete grace and sweep: sweeper hard-delete also removes blobs (files: `os.Remove`; S3: `DeleteObject`), best-effort with logging; orphan sweep job compares DB rows to store contents.
-
-### Recommendation
-
-**Filesystem-on-volume first.** At current scale (single replica, PVC-based deploy, one user + homelab traffic) it is simpler end-to-end and keeps serving/auth/lifecycle in one place. The internal API should be a narrow blob interface (`Put(ctx, key, r io.Reader, size int64) / Open(key) / Delete(key)`) — about 60 lines per backend — so **MinIO becomes a drop-in later** if attachments outgrow the volume. That's the honest middle path: filesystem default, S3-ready seam, no MinIO dependency until it pays for itself.
-
-## Part B — SQLite vs Postgres vs Redis (#31)
-
-### Assessment of SQLite at pastebin scale
-
-- **Driver**: modernc.org/sqlite (pure Go, no cgo) — slightly slower than mattn/go-sqlite3 but fine; single-writer semantics are the real constraint, not driver speed.
-- **Access pattern**: paste-heavy, write-rare/read-often; primary keys and small set of indexes (visibility+created, expires, deleted); no joins beyond can items. This is SQLite's best case.
-- **WAL mode** is already on (`journal_mode(WAL), busy_timeout(5000)`) — concurrent readers don't block the single writer.
-- **Numbers**: SQLite comfortably handles millions of rows and hundreds of reads/sec; WAL write throughput is thousands of small inserts/sec. A pastebin doing even 100k pastes (avg 10 KB = ~1 GB DB) is trivial. Reads: prepared `WHERE id=?` lookups at this size are sub-millisecond.
-- **Weak points to watch** (document, none urgent):
-  1. Single writer — heavy concurrent create traffic serializes. Mitigation: already rate-limited (#2); fine until that's the bottleneck (unlikely).
-  2. `LENGTH(content)` on every list row — fine now; if it shows up in profiling, store `size` as a column (schema already has a `Size` field; list queries could use it).
-  3. Sweeper runs a table-wide `UPDATE`+`DELETE` on tick — indexed, fine.
-  4. No network access to the DB file — locks palette to single-replica. Acceptable: current deploy is one replica.
-- **Redis is the wrong tool** here: it's a cache/queue, not a system of record. Pastes are durable data with expiry semantics already implemented in SQLite. Redis would only add an optional read-cache layer for hot pastes — pure complexity for zero measured need.
-
-### Should we build a backend abstraction (SQLite default, optional Postgres)?
-
-Arguments for: multi-replica scaling later; "docker image env choice" sounds nice; Postgres gives real concurrency and network access.
-Arguments against: a `Store` interface covering the current query surface is a real refactor (sqlite-flavored SQL: `INSERT OR IGNORE`-style upserts, partial indexes, `?` placeholders are compatible but behaviors differ — e.g. `sqlite` driver pragmas, transaction isolation, `AUTOINCREMENT` semantics); two backends means two test matrices and two migration paths forever; and there is **no current need** — single replica, single writer, modest data.
-
-**Recommendation: stay SQLite-only. Do not build the abstraction now.**
-Specifically:
-
-1. Keep all persistence behind `internal/store` (already done in #35 — the package boundary *is* the abstraction, at zero cost).
-2. Avoid SQLite-specific SQL going forward where free (standard placeholders, no `RETURNING` quirks) — cheap discipline that keeps a future port honest.
-3. Define the trigger conditions for revisiting, and write them down:
-   - multiple replicas needed (scale-out), or
-   - sustained WAL write contention (busy timeouts observed in logs), or
-   - DB file > ~5-10 GB, or
-   - a concrete user request for a Postgres-backed image.
-4. When a trigger fires, port `internal/store` to Postgres behind an interface extracted *then* — the refactor is mechanical against a real need, instead of speculative complexity now.
-5. For the docker image: `PALETTE_DB_PATH` env already implies the deployment choice; no extra backend knob needed.
-
-## Summary
-
-| Decision | Choice |
-|---|---|
-| Attachment backend | Filesystem on PVC, behind a ~3-method blob interface; MinIO as a later drop-in, not a dependency |
-| Size limits | `max_attachment_bytes` admin setting, default 10 MiB, enforced pre-read + during stream |
-| MIME | Server-side sniff (512 bytes) + allowlist; `nosniff`, CSP `sandbox`, `Content-Disposition: attachment` except safe-inline types; SVG never inline |
-| Database | SQLite (WAL, modernc) only; no Postgres/Redis, no backend abstraction until a written trigger fires |

docs/design/cookie-preferences.md

@@ -1,160 +0,0 @@
-# Design: Cookie-Based Preferences and Access Keys (#30)
-
-Status: design note — no implementation yet.
-Related: #37 (vwr viewer cookie), #34 (HMAC unlock cookie), #26 (creator auto-unlock), #36 (settings gear).
-
-## Current cookie surface
-
-| Cookie | Purpose | Lifetime | Flags today |
-|---|---|---|---|
-| `vwr` | Anonymous viewer id; scopes `/mine` history and burn-after-N per-viewer dedupe; client-sent `vwr` also authorizes delete | 1 year | `HttpOnly`, `SameSite=Lax`, `Path=/` |
-| `pw_<id>` | Per-paste password unlock token = HMAC(paste id, PALETTE_UNLOCK_SECRET) | 1 hour | `HttpOnly`, `SameSite=Lax`, `Path=/` |
-| `tok_<id>` | One-time deletion-token handoff after create | 60 s | `HttpOnly`, `SameSite=Lax`, `Path=/` |
-
-The access-key feature is an extension of the `pw_<id>` pattern, not a new mechanism.
-
-## Part 1: Preference storage
-
-### What settings
-
-Only settings the *creator* sets when writing a paste, so the "new paste" form
-can pre-fill them:
-
-- Default language (`lang`)
-- Default expiry (`expires_in` / custom expiry)
-- Burn-after-N-reads default
-- Password-protect-by-default toggle (checkbox pre-checked; the password itself is never stored)
-- Default visibility of the "raw" link, if such a toggle exists
-- Collapsed/expanded state of the settings gear panel itself
-
-Never stored in cookies: passwords, access keys for pastes the user hasn't
-unlocked, deletion tokens (beyond the existing 60 s `tok_` handoff), anything
-typed into the paste body or title fields (existing rule: auto-detect must not
-overwrite user-typed content).
-
-### One cookie, not many
-
-A single `prefs` cookie holding a compact JSON object:
-
-```
-prefs={"lang":"go","exp":"1h","burn":0,"pw":1}
-```
-
-- One cookie avoids the browser per-domain cookie count (typically 50+ per
-  domain; Chrome 180) eating the budget that per-paste access-key cookies need.
-- Per-paste cookies (`pw_<id>`) are inherently name-per-paste and cannot be
-  consolidated — that's the constraint that makes a single `prefs` cookie
-  mandatory rather than stylistic.
-
-### Size limits
-
-- RFC 6265: user agents SHOULD support at least 4096 bytes per cookie. Keep
-  `prefs` under 256 bytes of JSON — it holds a handful of short enum values.
-- Server behavior: if the cookie is present but oversized/invalid JSON, ignore
-  it silently and serve defaults. Never reject a request over a bad preference
-  cookie.
-- Validate on the server (allowlist of known values); a cookie is untrusted
-  input like any header.
-
-### Flags
-
-`HttpOnly; SameSite=Lax; Path=/; Max-Age=31536000; Secure` (Secure once the
-prod instance serves HTTPS — it will, behind the letsencrypt IngressRoute;
-dev on plain HTTP needs the flag conditional on config).
-
-Preferences are not sensitive, but `HttpOnly` costs nothing and keeps script
-from mutating them; `SameSite=Lax` matches the existing cookies.
-
-## Part 2: Access-key cookies
-
-### Goal
-
-"Remember unlocked pastes on this browser" — after entering a password (or
-after creating a private paste), subsequent visits skip the unlock form. This
-extends `pw_<id>` from a 1-hour session convenience to a durable capability.
-
-### Design: extend `pw_<id>`, don't invent a new scheme
-
-The token is already HMAC(paste id, PALETTE_UNLOCK_SECRET) — unforgeable and
-per-paste (fix for the #34 bypass). Changes:
-
-1. **Opt-in checkbox on the unlock form** ("remember on this browser") and a
-   matching checkbox/note at creation time. Default OFF. Non-consenting
-   visitors keep the current 1-hour cookie.
-2. **Extended lifetime** when opted in: `Max-Age = min(paste expiry, 90 days)`.
-   The cookie must never outlive the paste — derive the cap from the paste's
-   `ExpiresAt` at unlock time. Burn-after-N pastes: cap short (e.g. 24 h),
-   since the paste may burn at any read.
-3. **Name collision**: paste ids are fixed-length server-generated, so
-   `pw_<id>` names stay bounded (~40 bytes each). With the 50-cookies-per-
-   domain budget, cap remembered pastes at ~30: when minting the 31st, drop
-   the oldest expired-paste cookies server-side (server knows which ids are
-   expired/deleted; send expired `Set-Cookie` with `Max-Age=0` to reclaim).
-4. **Delete authorization interplay**: today a client-sent `vwr` matching the
-   paste's ViewerID authorizes delete. Access-key cookies grant *read*
-   capability only. Do not let a `pw_<id>` cookie authorize deletion — that
-   would mean cookie theft escalates from "read a paste" to "destroy it".
-   Delete stays bound to `vwr` or the deletion token.
-
-### Scoping
-
-- Keep `Path=/` (paste URLs are `/{id}` at the root; per-paste `Path=/{id}`
-  would work but saves nothing and complicates cleanup).
-- Per-paste scope via the cookie *name* is the existing, tested pattern —
-  no shared "access key ring" cookie. A consolidated `keys` cookie would
-  mean one stolen cookie exposes every remembered paste at once.
-
-## Part 3: Security considerations (honest accounting)
-
-- **XSS exfiltration**: `HttpOnly` prevents JS from *reading* the cookies, but
-  not from *using* them — an XSS payload can simply `fetch('/<paste-id>')` and
-  exfiltrate the content through the page the cookie unlocks. HttpOnly raises
-  the bar (drive-by script can't dump the jar to an attacker server in one
-  request), it does not make access-key cookies safe. This is a real
-  limitation, not a solved problem. Mitigations in order of value:
-  1. Fix the stored-XSS class at the source — #34 already allowlisted
-     content-types on `/raw`; the standing debt items (CSP, X-Frame-Options,
-     Referrer-Policy) directly reduce cookie-use exfiltration and should land
-     before or with this feature.
-  2. Keep access-key cookies opt-in, so the blast radius is bounded to users
-     who accepted the tradeoff.
-- **Cookie theft = paste access**: anyone holding `pw_<id>` can read that
-  paste until the cookie or paste expires, from any machine. That is inherent
-  to capability cookies. Consequences accepted deliberately: pastes here are
-  ephemeral (1 min–1 yr expiry), passwords are low-stakes share convenience,
-  and there are no user accounts to compromise. Document this in the UI copy
-  ("stores unlock access on this browser").
-- **Shared machines**: a remembered cookie defeats the password for the next
-  user of the browser. The opt-in checkbox with plain-language copy is the
-  mitigation; do not default it on.
-- **Cookie tossing / fixation**: a subdomain attacker could try to force
-  cookies; palette is a single host, no untrusted subdomains. `SameSite=Lax`
-  blocks cross-site attachment of the cookies on form posts to unlock
-  endpoints.
-- **Multi-instance / secret rotation**: tokens are HMACs under
-  `PALETTE_UNLOCK_SECRET`; rotating the secret silently invalidates all
-  remembered cookies (acceptable — next visit re-prompts). Both dev and prod
-  k3s instances need the same secret only if sharing a domain, which they do
-  not.
-- **Preferences cookie**: not security-sensitive, but still validate/allowlist
-  server-side to avoid it becoming an injection sink into templates.
-
-## Recommendation
-
-Implement in two small, separately reviewable pieces:
-
-1. **`prefs` cookie** (do first, low risk): single JSON cookie < 256 bytes,
-   server-validated allowlist, `HttpOnly; SameSite=Lax; Max-Age=1y`, drives
-   only form pre-fill. Ship with #36's settings gear.
-2. **Extended `pw_<id>` opt-in** (second, security-sensitive): opt-in checkbox,
-   Max-Age capped by paste expiry (90-day ceiling, 24 h for burn pastes),
-   oldest-cookie eviction at ~30 pastes, no delete authorization from access
-   cookies, and land the CSP/X-Frame-Options hardening debt from #34 in the
-   same or preceding change. UI copy must disclose that the cookie preserves
-   paste access on the browser.
-
-Rejected alternatives: single consolidated access-key cookie (aggregate theft
-risk, and the per-domain cookie-count argument cuts the other way for keys —
-consolidation maximizes what one stolen cookie unlocks); localStorage for
-preferences (XSS-readable, no benefit over HttpOnly cookies here); server-side
-accounts/session table (out of scope — Palette is deliberately anonymous).

docs/design/e2e-encryption.md

@@ -1,223 +0,0 @@
-# Design: Optional client-side E2E encryption for pastes and files
-
-- **Issue:** #39
-- **Status:** Design (no implementation in this PR)
-- **Related docs:** [docs/API.md](../API.md)
-
-## 1. Goals and non-goals
-
-**Goals**
-
-- Let any paste (or can item) be stored server-side as ciphertext only.
-- Zero plaintext knowledge by the server: storage, logs, backups, DB dumps contain no readable content.
-- Pure browser implementation using WebCrypto; no new server dependencies.
-- Encrypted pastes must still work with expiry, hard/soft delete, deletion tokens, visibility, slugs, rate limits.
-
-**Non-goals (v1)**
-
-- Anonymous, account-less E2E; Palette stays server-trusting with browser cookies.
-- Sharing via link fragments (`#key`) is optional sugar, not a required transport.
-- Search *of encrypted content*, server-side language detection, or server-side highlighting on encrypted pastes — these are structurally impossible and out of scope (see §5).
-- Signing, deniability, forward secrecy across pastes, PFS, post-quantum crypto.
-
-**Threat model (explicit).** This protects against a *passive server compromise* — a DB dump, backup leak, or disk image of the server's SQLite file. It does **not** protect against:
-
-- A fully malicious / compromised Palette server serving backdoored JavaScript: any JS-delivered crypto can be backdoored (key exfiltration via JS) regardless of primitives. This is the fundamental limit of a JS-in-browser E2E scheme.
-- Malware on the viewer's device, or shoulder-surfing of the password.
-- Traffic analysis, timing, or metadata (title, size, expiry, IP, viewer cookie).
-- A attacker who compromises the server *while the creator's browser is open* and alters JS before encrypt.
-
-Be explicit in user-facing copy: "encrypted at rest; the server cannot read your paste" is accurate — "the server can never see your paste" is not.
-
-## 2. Crypto primitives and flow
-
-### 2.1 Recommended parameters
-
-| Parameter | Recommendation | Notes |
-|---|---|---|
-| Cipher | **AES-256-GCM** | `AES-GCM` with a 256-bit key, per-paste random 96-bit IV/nonce. WebCrypto built-in, hardware-accelerated, authenticated. |
-| KDF | **PBKDF2-HMAC-SHA-256** | 600,000 iterations (OWASP 2023+ recommendation), 16-byte random salt. |
-| Argon2id | **Not in v1** | WebCrypto has no Argon2id; a JS/WASM Argon2 implementation is an extra supply-chain dependency and is an asymmetric liability: a script the server could swap can't be load-bearing for security anyway. Add later via `argon2id` WASM with SRI pinning + CSP (`script-src 'self'`) if needed. |
-| Salt | 16 random bytes per paste, stored in the clear alongside ciphertext | Unique per paste, never reused. |
-| IV | 12 random bytes per encryption | With ~2^32 encryptions per key this is negligible; each paste has its own key anyway. |
-| Key check value | See §2.2 | Catches wrong passwords without a server round-trip and prevents trash writes. |
-
-### 2.2 Flow (create)
-
-1. User checks "Encrypt" and enters an encryption passphrase (distinct from any access password) in `/new`.
-2. Browser generates `salt` (16 B) and `iv` (12 B) via `crypto.getRandomValues`.
-3. `crypto.subtle.importKey("raw", passphrase, "PBKDF2", false, ["deriveKey"])` →
-   `crypto.subtle.deriveKey(PBKDF2-SHA-256, 600k iterations, salt, {name:"AES-GCM", length:256}, false, ["encrypt","decrypt"])`.
-4. Generate a 32-byte random **DEK** (`crypto.getRandomValues(32)`).
-5. Content encryption key check: `iv_ckv`, `encrypted_content = AES-GCM-256(DEK, iv, content)`.
-6. **Key check value (KCV):** compute `AES-GCM-DEK(random 16 bytes)` — a small token encrypted *under the DEK*, stored as `key_check` blob. This is decrypted with the derived key; on wrong password GCM auth fails and the client can show "wrong key" without asking the server to burn a read.
-7. Wrap the DEK with the KEK: `wrapped_dek = AES-GCM(KEK, iv_wrap, dek)`.
-8. The stored envelope format:
-   ```
-   {
-     v: 1, kdf: "PBKDF2-SHA256", iterations: 600000, salt_b64, iv_b64,
-     kdf_salt_b64, wrap_iv_b64, wrapped_dek_b64, key_check_b64, ciphertext_b64
-   ```
-   The `v` field allows migrating to Argon2id later without a breaking change.
-8. POST the envelope (base64) as `content`, with an `encryption` metadata object alongside (see §3.1).
-
-### 2.3 Flow (view)
-
-1. User provides the passphrase via form field, or the key arrives in the URL `#fragment`. The encryption passphrase is a separate field from any access password.
-2. Fetch `/api/pastes/{id}` (with access password in the usual field if the paste is also password-gated).
-3. Derive KEK from passphrase+salt, unwrap DEK via key_check / unwrap step.
-4. Decrypt content with the DEK; on `OperationError` → "wrong passphrase" UI state (retries are client-side only; no re-fetch, so no extra burn-after-read charge).
-5. Language detection happens client-side (e.g. highlight.js auto-detect) on the decrypted plaintext.
-
-### §2.4 File and can items
-
-Files in cans: encrypt each file with its own DEK and store the same envelope. Cans' `json_items` content fields each carry their own envelope. Files keep their mime type in cleartext metadata; only the bytes are encrypted. The can's title stays plaintext (unless the whole can is encrypted, v2).
-
-## 3. API shapes
-
-### 3.1 Create request
-
-Existing fields unchanged. New optional `encryption` object:
-
-```json
-POST /api/pastes
-{
-  "content": "<base64 envelope>",
-  "encryption": {"v": 1, "kdf": "PBKDF2-SHA256", "iterations": 600000,
-                 "salt": "b64", "iv": "b64", "key_check": "b64"}
-}
-```
-
-`encryption` is non-secret KDF metadata for UI display; the server treats `content` as opaque bytes and MUST NOT inspect it for encrypted pastes (no detection, no highlighting prep, no search indexing) — enforced where content is written, not per-handler.
-
-The full envelope can also just live inside `content` (server-opaque); the `encryption` object carries only non-secret KDF metadata the list views need (e.g. to show a 🔒 icon).
-
-### 3.2 Create response
-
-Unchanged shape: `id`, `url`, `raw_url`, `api_url`, and the one-time `deletion_token` documented in docs/API.md.
-
-### 3.3 Get response
-
-`GET /api/pastes/{id}` response gains:
-
-```json
-{
-  "id": "abc123",
-  "content": "BASE64_ENVELOPE",
-  "encryption": {"v":1, "kdf": "PBKDF2-SHA256", "iterations": 601570, "salt": "b64", "iv": "base64", "key_check": "b64"},
-  "reads_remaining": null
-}
-```
-
-`language` is `"encrypted"` or `null` so clients don't run detection on ciphertext. `raw_url` also serves the envelope; the `/{id}` page ships it to the browser, which decrypts in place.
-
-### 3.4 Raw endpoint
-
-`GET /raw/{id}` returns the envelope as `application/octet-stream` with a suggested filename like `{id}.e2e.txt` and `Content-Disposition: attachment`. This is deliberate: a "download encrypted blob" is what a non-browser client can do with it anyway.
-
-### 3.5 List views / mine / public
-
-List endpoints return `has_encryption: true` instead of content; show a lock icon. Do not include ciphertext in list responses (size, and no reason to ship ciphertext to every viewer's list view) — `GET /api/pastes/{id}` remains the only endpoint that returns the envelope.
-
-`/api/mine` (creator's own browser) may include the envelope for convenience; `/api/public` returns metadata only.
-
-`/api/guess-language` rejects encrypted content with `400 "content is client-encrypted"` — detection needs plaintext; clients detect after decrypting.
-
-Delete, redeem, rate limits, expiry, sweeper, deletion tokens, visibility, slugs, and can CRUD are unchanged — the server never inspects content for these, so opaque content is a no-op path.
-
-## 4. Interplay with existing features
-
-| Feature | Impact | Mitigation |
-| Burn-after-read | Budget is charged on fetch, exactly as today; the server cannot know whether decryption succeeded, so a viewer fetching with the wrong key burns a read they can't use. | Decrypt retries are client-side, so only the first fetch charges the budget. Clear UX copy. |
-| Password-protected + encrypted | Both can coexist and are independent: the access password is an HTTP 401 gate; the encryption passphrase never leaves the browser. If both are set, all three secrets are needed (URL + access password + passphrase). Warn if the user enters the same value in both fields. |
-| Encryption-only pastes | Supported with no access password: URL + passphrase (or fragment key). Default is passphrase; fragment key is opt-in with a warning. |
-| Search | Structurally impossible over ciphertext. Server search just skips encrypted pastes; client-side search within a single decrypted paste works fine. No global encrypted-content search — accept the loss, document it. |
-| Language detection / highlighting | Server-side detection/highlighting impossible; returns `language: null`. Client-side detection via highlight.js auto-detect on decrypted plaintext (client already loads it for password gate pages). |
-| Cans/files | Per-item envelopes (own DEK each), per §2.4. | Consider a can-level KEK (one passphrase unlocks all items). |
-| Expiry/sweeper/delete/redeem | Unchanged — server never inspects content for these. |
-| List views (`/api/public`, `/api/mine`) | Additive `has_encryption: true` flag; list responses do not include ciphertext (`/api/mine` may include the envelope for the creator's own convenience). |
-| guess-language endpoint | Reject with 400. |
-| Fork / edit | Re-encryption needs the passphrase in the browser; v1 disables forking encrypted pastes. | Document the limitation. |
-
-## 5. What breaks, stated plainly
-
-- **Search across encrypted pastes: impossible.** Accept the loss. (If ever needed, client-side index in IndexedDB for the creator's own pastes — v2+.)
- IndexedDB only helps the creator, not other viewers; still not global search. Accept the loss.
-- **Server-side language detection and highlighting: impossible.** Client-side detection on decrypted plaintext. Server returns `language: null` and the client detects.
-- **Burn-after-read is weakened in one specific way:** the budget is counted on fetch, not on successful decryption. A viewer who fetches but can't decrypt (wrong/lost key) burns a read they can't use. Mitigations documented in §4 table. The server can still count fetches (which is what burn-after-read actually is, even today: it counts fetches, not "reads" in any content-aware sense). So burn-after-read still works — it counts fetches — it's just that a failed decryption still consumes budget. This is acceptable and just needs UX copy. Optionally: don't decrement on failed decryption is *not possible* the server can't tell, so it's fetch-based, period. (It already is today.)
-- **Raw endpoint semantics change:** `/raw/{id}` can no longer serve readable raw text. It serves the ciphertext envelope. Scripts that curl raw pastes will get base64 envelope instead of text. Document as a breaking-ish change for encrypted pastes only; unencrypted pastes unchanged.
-- **Existing /api/mine, /api/public list shapes gain a flag** (additive, non-breaking).
-- **Copy-to-clipboard of decrypted text stays client-side**, fine. "Copy raw" on an encrypted paste copies the envelope — label it clearly.
-
-## 5. UX for key sharing
-### 5.1 Three sharing modes
-
-| Mode | What's shared | Security level | Use case |
-|---|---| malformed JSON / wrong key | | |
-| Mode | What's shared | Strength | Use case |
-|---|---|---|---|
-| **Passphrase** (default) | URL + passphrase out-of-band (Signal etc.) | Good — two channels | Team snippets, sensitive configs |
-| **Passphrase + access password** | URL + access password (401 gate) + passphrase | Strong — two secrets, two channels | Highest sensitivity |
-| **Random key in `#fragment`** | URL containing `#key=<b64>` | Weak — single channel; anyone with the full URL has both parts. Copy/paste into chat defeats it entirely. | One-click convenience sharing |
-
-Browsers never transmit `#` fragments to servers; still set `Referrer-Policy: no-referrer` site-wide and offer separate copy buttons for URL and key. Key-in-fragment ships with a warning and stays opt-in.
-
-### 5.2 Create page (`/new`) UX
-
-- "Encrypt content" toggle → reveals passphrase field + strength meter + generate-random-key button.
-- When encrypting, hide the server-side language dropdown; the client detects language after decryption.
-- Two separate inputs with distinct labels: "Access password (checked by the server, 401 gate)" and "Encryption passphrase (never leaves your browser)". If both hold the same value, warn.
-
-### 6.2 View page (`/{id}`) UX
-
-- If `encryption.kdf` is present → show key entry UI (after the access-password 401 gate, if that also applies).
-- After decrypt: normal render pipeline, language detected client-side.
-- "Wrong passphrase" retries never re-fetch, so they never burn extra reads.
-
-## 7. Backwards compatibility and migration
-
-- Additive JSON fields only; unencrypted pastes behave identically. No schema changes (envelope is stored in the existing content column/TEXT; verify column size allows envelope overhead (~2× base64 + ~200 B header).
-- Server-side validation of encrypted pastes: only structural checks (base64 decodes, size ≤ max bytes). No crypto in the server.
-
-**Server implementation cost is genuinely small** (est. 2-4 days): pass through content untouched, add `encryption` metadata column or embed in content, skip detection/indexing when `encryption` is present, list flag. The server never does crypto. All crypto is client-side JS (~150-300 lines, no build-step change if using WebCrypto alone).
-
-**Argon2id later:** add `kdf: "argon2id"` to the envelope `v: 1` (m=64 MiB, t=3, p=1) via a SRI-pinned WASM module, with CSP `script-src 'self'` + SRI on the script tag. Envelope `v` field already allows this.
-
-## 8. Recommendation
-
-**Build it, as an opt-in checkbox, passphrase mode only in v1.**
-
-- Server cost is small (pass-through + skip detection/indexing + list flag), client cost moderate (WebCrypto only, no new deps).
-- It closes the biggest real-world risk for a public pastebin: a DB/backup leak exposing every paste ever written.
-- Skip Argon2id in v1; envelope `v` field provides a migration path.
-- Key-in-fragment mode: build the plumbing (fragment parsing) but hide behind "advanced"; default remains passphrase.
-
-**Do not build:** server-side search over encrypted content, server-side highlighting of encrypted content, decrypt-on-server "preview" mode, or any server-side crypto.
-
-## 9. Open questions
-
-1. Size limits: base64 expansion (~4/3×) plus ~200 B envelope overhead; the existing max-bytes / 413 limit applies to the envelope bytes the server stores. Do not compress before encrypting (CRIME-style weaknesses).
-2. Fork/edit of encrypted pastes: disabled in v1, revisit.
-3. Should `/api/mine` include the full envelope in list view? Leaning yes (creator's own browser can decrypt); note the larger payload.
-4. Should there be a "verify passphrase" second field at create time (type-twice), or rely on the KCV check at view time? KCV at view time suffices; type-twice adds friction at create. Rely on KCV, skip type-twice.
-5. CSP/Referrer-Policy hardening: `Referrer-Policy: no-referrer` site-wide is worth doing regardless of this feature (it also benefits unencrypted pastes).
-6. Cans: per-item DEKs wrapped by a single can-level KEK (one passphrase unlocks all items) — better UX, slightly more envelope design work. Defer detail to implementation.
-
-## 10. Alternatives considered
-
-| Alternative | Why not in v1 |
-|---|---|
-| Argon2id via WASM in v1 | Extra JS dependency the server could swap → can't be load-bearing; PBKDF2-600k is adequate for a pastebin. Defer. |
-| Server holds half a key (2-of-2 with server-held share) | Re-introduces server trust; defeats the purpose. |
-| age-format envelopes | Nice CLI interop but no WebCrypto-native support; adds a JS dependency. Defer. |
-| PGP / S-MIME | Poor browser UX; heavy dependencies. |
-| Server-side encryption with server-held keys | Not E2E; that's "encrypted at rest", already covered by disk-level encryption. |
-| PrivateBin-style fragment key only | Single-channel sharing is a footgun; keep passphrase as default. |
-| libsodium / tweetnacl | Solid but unnecessary; WebCrypto covers AES-GCM + PBKDF2 natively. |
-
-## 11. References
-
-- OWASP Password Storage Cheat Sheet (PBKDF2 guidance): https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html
-- MDN WebCrypto: https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypto
-- PrivateBin (prior art for fragment-key sharing): https://privatebin.info
-- 0bin, Hemmelig — other pastebin/secret E2E prior art.

docs/performance-notes.md

@@ -1,60 +0,0 @@
-# Performance notes (#32)
-
-Background: history and saved pages filter client-side. Each load fetches the
-most recent rows from the list endpoint (`limit=500` per query is the current
-client cap in `static/table.js`) and filters/sorts in the browser. This note
-records current behavior, measured latency, and the design for a future
-server-side search endpoint. Measurements only — no implementation in #4/#32.
-
-## Current behavior
-
-- `/api/public?limit=500&offset=0` and `/api/mine?limit=500&offset=0` return up
-  to 500 rows (id, title, language, created_at, view_count, size,
-  custom_slug, is_can). Content is NOT included — only `LENGTH(content)`.
-- The browser applies the search-box filter (title/language/id substring) and
-  column sorting locally over the fetched window.
-- Consequence: search only covers the fetched window (500 most recent rows).
-  Older rows are invisible to search until paginated through, and each query
-  ships ~4 KB of row metadata regardless of how few rows the user will look at.
-
-## Measured latency (synthetic rows, scratch SQLite DB)
-
-Rows are synthetic pastes (~200 B content each, indexed like production:
-`idx_pastes_visibility_created`). Queried `GET /api/public?limit=500`
-(modernc.org/sqlite, WAL, single connection — same as production).
-
-| Rows in table | Bulk insert | First query | Avg query (10 runs) | Payload |
-|---|---|---|---|---|
-| 1,000 | 19 ms | 1.0 ms | 0.44 ms | ~4.1 KB |
-| 5,000 | 95 ms | 1.0 ms | 0.98 ms | ~4.1 KB |
-| 10,000 | 189 ms | 2.0 ms | 1.78 ms | ~4.1 KB |
-
-Interpretation:
-
-- The list query itself is cheap (< 2 ms at 10k rows); latency users perceive
-  comes from network + browser rendering of 500 rows, not SQL.
-- The current design scales fine to ~10k pastes. Beyond that, shipping 500
-  rows per keystroke-refresh cycle is wasteful and search coverage stays
-  capped at the window.
-
-## Future design: server-side `/api/search?q=` (#32 remainder)
-
-- Endpoint: `GET /api/search?q=<term>&limit=25&offset=0`.
-- SQL: `SELECT ... FROM pastes WHERE deleted_at IS NULL AND (expires_at IS NULL
-  OR expires_at > ?) AND (title LIKE ? OR content LIKE ?) ORDER BY created_at
-  DESC LIMIT ? OFFSET ?` — term wrapped as `%term%`, escaped (`%`, `_`).
-  Visibility scoping mirrors ListPublic/ListMine (`public` + `viewer_id` for
-  the saved-page variant).
-- Indexing: LIKE with a leading wildcard cannot use a B-tree index. Options,
-  in order of effort:
-  1. Accept a table scan — fine at ≤ ~50k rows (10k rows scanned in ~2 ms).
-  2. Add an index on `title` for prefix search (`q*`) and keep `%q%` scan only
-     as a fallback.
-  3. SQLite FTS5 virtual table (`CREATE VIRTUAL TABLE pastes_fts USING
-     fts5(title, content)`) for token search — best relevance, needs sync on
-     insert/delete and a migration.
-- Cans: search should cover can titles/descriptions too (UNION ALL with
-  `paste_cans`, `is_can=1`), matching the #4 listing integration.
-- Response shape: same row objects as `/api/public` (plus `is_can`) so
-  `table.js` can render results without a second code path; the client filter
-  becomes a server query when `q` is non-empty.

internal/api/burnreads_test.go

@@ -46,6 +46,33 @@ func getWithCookie(t *testing.T, h anyHandler, id, viewer string) *httptest.Resp
 	return rec
 }
 
+// #82: burn_after_reads > 0 alone must enable burn-after-read
+// even without burn_after_read: true.
+func TestBurnReadsImpliedByBurnAfterReads(t *testing.T) {
+	s := testServer(t)
+	h := s.routes()
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"implied","burn_after_reads":2}`))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	if rec.Code != 201 {
+		t.Fatalf("create burn_after_reads-only: %d %s", rec.Code, rec.Body.String())
+	}
+	var created struct {
+		ID string `json:"id"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &created)
+
+	if rec := getWithCookie(t, h, created.ID, "aaa"); rec.Code != 200 {
+		t.Fatalf("read 1: %d", rec.Code)
+	}
+	if rec := getWithCookie(t, h, created.ID, "bbb"); rec.Code != 200 {
+		t.Fatalf("read 2: %d", rec.Code)
+	}
+	if rec := getWithCookie(t, h, created.ID, "ccc"); rec.Code != 404 {
+		t.Fatalf("read 3 expected 404 (burned), got %d", rec.Code)
+	}
+}
+
 func TestBurnAfterNReadsDistinctViewers(t *testing.T) {
 	s := testServer(t)
 	h := s.routes()

internal/api/cans.go

@@ -28,7 +28,7 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 		visibility = "public"
 	}
 	if visibility != "public" && visibility != "unlisted" {
-		writeErr(w, 400, "visibility must be public or unlisted")
+		writeErrCode(w, 400, "invalid_visibility", "visibility must be public or unlisted")
 		return
 	}
 	expiresIn := r.FormValue("expires_in")
@@ -40,13 +40,13 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 	if expiresIn != "" {
 		d, err := time.ParseDuration(expiresIn)
 		if err != nil {
-			writeErr(w, 400, "invalid expires_in")
+			writeErrCode(w, 400, "expiry_invalid", "invalid expires_in")
 			return
 		}
 		// #60/#48: clamp at the API boundary like the pastes API does -
 		// reject zero/negative and durations past the 1-year UI cap.
 		if !store.ValidExpiry(d) {
-			writeErr(w, 400, "expires_in must be between 1 minute and 1 year")
+			writeErrCode(w, 400, "expiry_invalid", "expires_in must be between 1 minute and 1 year")
 			return
 		}
 		t := now + int64(d.Seconds())
@@ -71,7 +71,7 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 	if err != nil {
 		switch err {
 		case store.ErrSlugTaken, store.ErrInvalidSlug, store.ErrReservedSlug:
-			writeErr(w, 409, err.Error())
+			writeErrCode(w, 409, createErrCode(err), err.Error())
 		default:
 			writeErr(w, 500, "db error")
 		}
@@ -137,7 +137,7 @@ func (a *apiServer) handleCreateCan(w http.ResponseWriter, r *http.Request) {
 
 	if itemCount == 0 {
 		a.store.DeleteCan(canID)
-		writeErr(w, 400, "can needs at least one item (files or json_items)")
+		writeErrCode(w, 400, "content_empty", "can needs at least one item (files or json_items)")
 		return
 	}
 

internal/api/issue105_errorcode_test.go

@@ -0,0 +1,123 @@
+package api
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"strings"
+	"testing"
+)
+
+// #105: every validation path on create returns a machine-readable `code`
+// alongside the human `error` message, so the new-page JS can map known
+// codes to plain-language guidance.
+
+func decodeErr(t *testing.T, rec *httptest.ResponseRecorder) (status int, errMsg, code string) {
+	t.Helper()
+	var got struct {
+		Error string `json:"error"`
+		Code  string `json:"code"`
+	}
+	if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
+		t.Fatalf("bad json: %v (%s)", err, rec.Body.String())
+	}
+	return rec.Code, got.Error, got.Code
+}
+
+func postCreate(h http.Handler, body string) *httptest.ResponseRecorder {
+	req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(body))
+	rec := httptest.NewRecorder()
+	h.ServeHTTP(rec, req)
+	return rec
+}
+
+func TestErrorCodeContentEmpty(t *testing.T) {
+	h := testServer(t).routes()
+	_, _, code := decodeErr(t, postCreate(h, `{"content":"   "}`))
+	if code != "content_empty" {
+		t.Fatalf("code = %q, want content_empty", code)
+	}
+}
+
+func TestErrorCodeContentTooLarge(t *testing.T) {
+	h := testServer(t).routes()
+	big := strings.Repeat("x", 6*1024*1024) // over the 5MB test cap
+	_, _, code := decodeErr(t, postCreate(h, `{"content":"`+big+`"}`))
+	if code != "content_too_large" {
+		t.Fatalf("code = %q, want content_too_large", code)
+	}
+}
+
+func TestErrorCodeSlugTaken(t *testing.T) {
+	h := testServer(t).routes()
+	if rec := postCreate(h, `{"content":"a","custom_slug":"taken-slug"}`); rec.Code != 201 {
+		t.Fatalf("seed create: %d %s", rec.Code, rec.Body.String())
+	}
+	_, _, code := decodeErr(t, postCreate(h, `{"content":"b","custom_slug":"taken-slug"}`))
+	if code != "slug_taken" {
+		t.Fatalf("code = %q, want slug_taken", code)
+	}
+}
+
+func TestErrorCodeSlugInvalid(t *testing.T) {
+	h := testServer(t).routes()
+	_, _, code := decodeErr(t, postCreate(h, `{"content":"a","custom_slug":"bad slug!"}`))
+	if code != "slug_invalid" {
+		t.Fatalf("code = %q, want slug_invalid", code)
+	}
+}
+
+func TestErrorCodeExpiryInvalid(t *testing.T) {
+	h := testServer(t).routes()
+	_, _, code := decodeErr(t, postCreate(h, `{"content":"a","expires_in":"2s"}`))
+	if code != "expiry_invalid" {
+		t.Fatalf("code = %q, want expiry_invalid", code)
+	}
+}
+
+func TestErrorCodeRateLimited(t *testing.T) {
+	h := testServer(t).routes()
+	var code string
+	for i := 0; i < 20; i++ {
+		_, _, code = decodeErr(t, postCreate(h, `{"content":"a"}`))
+		if code == "rate_limited" {
+			return
+		}
+	}
+	t.Fatalf("never got rate_limited, last code = %q", code)
+}
+
+func TestErrorCodeCanValidation(t *testing.T) {
+	h := testServer(t).routes()
+
+	post := func(fields map[string]string) *httptest.ResponseRecorder {
+		var b strings.Builder
+		for k, v := range fields {
+			b.WriteString("--B\r\nContent-Disposition: form-data; name=\"" + k + "\"\r\n\r\n" + v + "\r\n")
+		}
+		b.WriteString("--B--\r\n")
+		req := httptest.NewRequest("POST", "/api/pastes/can", strings.NewReader(b.String()))
+		req.Header.Set("Content-Type", "multipart/form-data; boundary=B")
+		rec := httptest.NewRecorder()
+		h.ServeHTTP(rec, req)
+		return rec
+	}
+
+	// bad visibility
+	if _, _, code := decodeErr(t, post(map[string]string{"title": "x", "visibility": "nope"})); code != "invalid_visibility" {
+		t.Fatalf("visibility code = %q, want invalid_visibility", code)
+	}
+
+	// invalid expiry
+	if _, _, code := decodeErr(t, post(map[string]string{"title": "x", "expires_in": "1s"})); code != "expiry_invalid" {
+		t.Fatalf("expiry code = %q, want expiry_invalid", code)
+	}
+
+	// slug taken on can create
+	if rec := postCreate(h, `{"content":"a","custom_slug":"can-slug"}`); rec.Code != 201 {
+		t.Fatalf("seed create: %d", rec.Code)
+	}
+	if _, _, code := decodeErr(t, post(map[string]string{"title": "x", "custom_slug": "can-slug", "json_items": `[{"title":"a","content":"b"}]`})); code != "slug_taken" {
+		t.Fatalf("can slug code = %q, want slug_taken", code)
+	}
+}

internal/api/ratelimit.go

@@ -113,7 +113,7 @@ func rateLimitAdmin(r *http.Request) bool {
 // writeRateLimited responds 429 with Retry-After based on refill rate.
 func writeRateLimited(w http.ResponseWriter, retryAfterSecs int) {
 	w.Header().Set("Retry-After", strconv.Itoa(retryAfterSecs))
-	writeErr(w, 429, "rate limit exceeded")
+	writeErrCode(w, 429, "rate_limited", "rate limit exceeded")
 }
 
 // setRateLimitHeaders sets informational X-RateLimit headers for create/guess.

internal/api/server.go

@@ -6,6 +6,7 @@ import (
 	"context"
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"html/template"
 	"net/http"
@@ -51,6 +52,30 @@ func writeErr(w http.ResponseWriter, status int, msg string) {
 	writeJSON(w, status, map[string]string{"error": msg})
 }
 
+// writeErrCode emits a JSON error with a machine-readable code (#105): the
+// new-page JS maps known codes to plain-language messages, API consumers get
+// the stable `code` field alongside the human `error` text.
+func writeErrCode(w http.ResponseWriter, status int, code, msg string) {
+	writeJSON(w, status, map[string]string{"error": msg, "code": code})
+}
+
+// createErrCode maps a store.CreatePaste/CreateCan error to its UI error
+// code (#105).
+func createErrCode(err error) string {
+	switch {
+	case errors.Is(err, store.ErrSlugTaken):
+		return "slug_taken"
+	case errors.Is(err, store.ErrReservedSlug):
+		return "slug_reserved"
+	case errors.Is(err, store.ErrInvalidSlug):
+		return "slug_invalid"
+	case strings.Contains(err.Error(), "expires_in"):
+		return "expiry_invalid"
+	default:
+		return "invalid_request"
+	}
+}
+
 // Routes returns the HTTP handler for the server.
 func (a *apiServer) Routes() http.Handler {
 	return a.routes()
@@ -158,14 +183,18 @@ func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
 	var p store.Paste
 	if err := json.NewDecoder(r.Body).Decode(&p); err != nil {
 		if isBodyTooLarge(err) { // #68: body cut off by MaxBytesReader
-			writeBodyTooLarge(w)
+			writeErrCode(w, http.StatusRequestEntityTooLarge, "content_too_large", "request body too large")
 			return
 		}
 		writeErr(w, 400, "invalid json body")
 		return
 	}
 	if status, msg := checkContent(p.Content, s.MaxContentBytes); status != 0 {
-		writeErr(w, status, msg)
+		if status == http.StatusRequestEntityTooLarge {
+			writeErrCode(w, status, "content_too_large", msg)
+		} else {
+			writeErrCode(w, status, "content_empty", msg)
+		}
 		return
 	}
 	// #86: bound free-form metadata at create time
@@ -203,7 +232,7 @@ func (a *apiServer) handleCreatePaste(w http.ResponseWriter, r *http.Request) {
 	p.ViewerID = currentViewerID(r)
 	created, err := a.store.CreatePaste(&p)
 	if err != nil {
-		writeErr(w, 400, err.Error())
+		writeErrCode(w, 400, createErrCode(err), err.Error())
 		return
 	}
 	writeJSON(w, 201, map[string]any{

internal/store/store.go

@@ -211,13 +211,17 @@ func (s *Store) CreatePaste(p *Paste) (*Paste, error) {
 		}
 	}
 
-	// #49: burn-after-read pastes carry a read budget (default 1 read)
-	if p.BurnAfterRead {
+	// #49/#82: burn-after-read pastes carry a read budget (default 1 read).
+	// burn_after_reads > 0 alone implies burn mode even without burn_after_read.
+	if p.BurnAfterRead || (p.BurnAfterReads != nil && *p.BurnAfterReads > 0) {
 		limit := int64(1)
 		if p.BurnAfterReads != nil && *p.BurnAfterReads > 0 {
 			limit = int64(*p.BurnAfterReads)
 		}
 		p.readsLimit = &limit
+		if !p.BurnAfterRead {
+			p.BurnAfterRead = true
+		}
 	}
 
 	visibility := p.Visibility

internal/web/securityheaders_test.go

@@ -16,7 +16,7 @@ func TestSecurityHeaders(t *testing.T) {
 	h := SecurityHeaders(pages)
 	rec := httptest.NewRecorder()
 	h.ServeHTTP(rec, httptest.NewRequest("GET", "/", nil))
-	wantCSP := "default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'"
+	wantCSP := "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'"
 	if got := rec.Header().Get("Content-Security-Policy"); got != wantCSP {
 		t.Errorf("CSP = %q, want %q", got, wantCSP)
 	}

internal/web/static/app.css

@@ -143,7 +143,7 @@ body {
 /* paste view */
 .meta-bar { display: flex; align-items: center; gap: 12px; padding: 12px 18px; flex-wrap: wrap; }
 .meta-bar h1 { font-size: 29.2px; font-weight: 600; }
-.slug { font-family: var(--font-mono); font-size: 21.6px; color: var(--muted-fg); background: var(--surface-2); padding: 3px 9px; border-radius: var(--radius); }
+.slug { font-family: var(--font-mono); font-size: 21.6px; color: var(--muted-fg); background: var(--surface-2); padding: 3px 9px; border-radius: var(--radius-sm); }
 .tag { font-size: 19.8px; color: var(--muted-fg); border: 1px solid var(--border); border-radius: var(--radius-sm); padding: 2px 9px; }
 .paste-title-bar { display: flex; align-items: center; gap: 12px; padding: 12px 18px; flex-wrap: wrap; }
 .paste-title-bar h1 { font-size: 29.2px; font-weight: 600; margin: 0; }
@@ -215,11 +215,8 @@ th {
   text-align: left; font-size: 18.9px; text-transform: uppercase; letter-spacing: .08em;
   color: var(--muted-fg); padding: 10px 16px; border-bottom: 1px solid var(--border); font-weight: 600;
 }
-/* #92: the sort-ind span is absolutely positioned in the cell's right gutter,
-   so it can't shift the header label right of the data cells. */
-th.sortable { cursor: pointer; user-select: none; position: relative; padding-right: 34px; }
-th.sortable .sort-ind { position: absolute; right: 12px; top: 50%; transform: translateY(-50%); margin-left: 0; }
-td { padding: 10px 16px; border-bottom: 1px solid var(--border); overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
+td { padding: 10px 16px; border-bottom: 1px solid var(--border); overflow: clip; text-overflow: ellipsis; white-space: nowrap; }
+td:has(> a.slug), td:has(> .slug) { overflow: visible; }
 tr:last-child td { border-bottom: none; }
 tr.row { cursor: pointer; }
 tr.row:hover td { background: var(--surface-2); }
@@ -299,6 +296,13 @@ td a.slug:hover { color: var(--accent); }
 .toast.success { border-color: var(--ok); color: var(--ok); }
 .toast.error { border-color: var(--err); color: var(--err); }
 
+/* result box color-coding (#105): colored left border + text tint per status */
+.result-ok, .result-err, .result-warn { border-left: 4px solid transparent; padding-left: 10px; }
+.result-ok { border-left-color: var(--ok); color: var(--ok); }
+.result-err { border-left-color: var(--err); color: var(--err); }
+.result-warn { border-left-color: var(--warn); color: var(--warn); }
+.result-ok a { color: var(--ok); }
+
 /* protection section rhythm (#20) */
 .protect { display: flex; flex-direction: column; gap: 2px; }
 .protect .pw-row { padding: 2px 8px 4px; }
@@ -351,17 +355,29 @@ td a.slug:hover { color: var(--accent); }
 /* paste name under slug pill in Paste column (#43) */
 .paste-sub { font-size: 19.8px; color: var(--muted-fg); margin-top: 2px; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }
 .paste-sub.dim { color: var(--muted); }
-td .url-link { font-size: 19.8px; }
+td a.slug.url-link { max-width: 100%; display: inline-block; vertical-align: middle; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; box-sizing: border-box; }
 td .id-link { color: var(--muted-fg); text-decoration: none; font-family: var(--font-mono); font-size: 19.8px; }
 td .id-link:hover { color: var(--accent); }
 
 /* sortable column headers (#42) */
 th.sortable { cursor: pointer; user-select: none; }
 th.sortable:hover { color: var(--fg); }
-.sort-ind { display: inline-block; width: 0; height: 0; margin-left: 6px; vertical-align: middle; border-left: 5px solid transparent; border-right: 5px solid transparent; }
+th.sortable { cursor: pointer; user-select: none; white-space: nowrap; }
+/* #101: arrow sits LEFT of the label, further spaced, vertically centered,
+   and absolutely positioned so it never shifts the label text. */
+th.sortable { position: relative; padding-left: 24px; }
+th.sortable .sort-ind {
+  position: absolute; left: 8px; top: 50%; transform: translateY(-50%);
+  display: inline-block; width: 0; height: 0;
+  border-left: 5px solid transparent; border-right: 5px solid transparent;
+}
 th.sorted.asc .sort-ind { border-bottom: 6px solid var(--accent); }
 th.sorted.desc .sort-ind { border-top: 6px solid var(--accent); }
 
+/* #102: small unobtrusive admin link on the settings page */
+a.admin-link { color: var(--muted-fg); font-size: 15px; text-decoration: none; }
+a.admin-link:hover { color: var(--fg); text-decoration: underline; }
+
 /* ============================================================
    Consistency audit (#18) — shared tokens across inputs, buttons,
    headings. Visual-only, no behavior change.

internal/web/templates/admin.html

@@ -44,7 +44,8 @@
 
   function api(path, opts) {
     opts = opts || {};
-    opts.headers = { 'X-Admin-Key': key() };
+    // allow callers to override the key header (e.g. validating a typed key, #99)
+    opts.headers = Object.assign({ 'X-Admin-Key': key() }, opts.headers || {});
     if (opts.body) opts.headers['Content-Type'] = 'application/json';
     return fetch(path, opts);
   }
@@ -72,9 +73,10 @@
 
   document.getElementById('admin-key-form').addEventListener('submit', function (e) {
     e.preventDefault();
-    sessionStorage.setItem(KEY, keyInput.value);
-    api('/admin/api/settings').then(function (r) {
+    // #99: don't persist the key until the server accepts it
+    api('/admin/api/settings', { headers: { 'X-Admin-Key': keyInput.value } }).then(function (r) {
       if (r.status === 200) {
+        sessionStorage.setItem(KEY, keyInput.value);
         status.textContent = '✓';
         keyInput.value = '';
         loadSettings();
@@ -101,7 +103,9 @@
     });
   });
 
-  if (key()) loadSettings();
+  // #112: always show the lock on fresh load — do not auto-restore the
+  // panel from a stale sessionStorage key. The key is only written after a
+  // successful unlock (above) so in-page actions still work within this visit.
 })();
 </script>
 {{template "foot" .}}

internal/web/templates/layout.html

@@ -3,9 +3,10 @@
 <meta name="viewport" content="width=device-width, initial-scale=1">
 <link rel="stylesheet" href="/static/app.css">
 <script>
-// preset preview hook (#16): ?theme=<name> sets data-preset for screenshots only
+// preset hook (#16): ?theme= wins; else persisted choice (#100)
 (function () {
   var t = new URLSearchParams(location.search).get('theme');
+  if (!t) try { t = localStorage.getItem('palette-theme'); } catch (e) {}
   if (t) document.documentElement.dataset.preset = t;
 })();
 </script>
@@ -13,7 +14,7 @@
 
 {{define "topbar"}}
   <div class="topbar">
-    <a class="logo" href="/history">Palette <em>/ beta</em></a>
+    <a class="logo" href="/history">Palette <em>/ {{ version }}</em></a>
     <nav>
       <a href="/new" {{if eq .Page "new"}}class="on"{{end}}>New</a>
       <a href="/history" {{if eq .Page "history"}}class="on"{{end}}>Public</a>

internal/web/templates/new.html

@@ -171,10 +171,37 @@ $('can-add').addEventListener('click', addCanItem);
 
 let guessed = ''; // last auto-detected language, '' = user override
 
-function showResult(html, isError) {
+// #105: map backend machine-readable error codes to plain-language guidance.
+// Unknown codes fall back to a generic message; the technical detail stays
+// in the API response for API consumers.
+const ERROR_MESSAGES = {
+  slug_taken: 'That Custom URL is already taken. Try another.',
+  slug_reserved: 'That Custom URL is reserved. Try another.',
+  slug_invalid: 'Please keep the Custom URL under 64 characters, using only letters, numbers, dashes, or underscores.',
+  content_empty: 'Write or paste something first.',
+  content_too_large: 'This paste is too large. The limit is 5 MB.',
+  expiry_invalid: 'Please pick an expiry between 1 minute and 1 year.',
+  rate_limited: 'Too many tries. Wait a minute and try again.',
+};
+const GENERIC_ERROR = 'Something went wrong. Please try again.';
+
+function friendlyError(data) {
+  return ERROR_MESSAGES[data && data.code] || GENERIC_ERROR;
+}
+
+// #105: color the result box by outcome — success (ok), error (err),
+// warning (warn) — with a colored left border (CSS .result-ok/.result-err).
+function setResultKind(kind) {
+  const card = $('result-card');
+  card.classList.remove('result-ok', 'result-err', 'result-warn');
+  if (kind) card.classList.add('result-' + kind);
+}
+
+function showResult(html, kind) {
   $('result').innerHTML = html;
-  $('result').dataset.token = isError ? '' : ($('result').dataset.token || '');
+  $('result').dataset.token = kind === 'ok' ? ($('result').dataset.token || '') : ($('result').dataset.token || '');
   $('result-card').style.display = 'block';
+  setResultKind(kind === 'ok' ? 'ok' : (kind === 'warn' ? 'warn' : 'err'));
 }
 function defaultFilename(lang) {
   const names = {
@@ -249,12 +276,12 @@ async function create() {
   });
   const data = await res.json();
   if (!res.ok) {
-    showResult('Error: ' + (data.error || res.status), true);
+    showResult(friendlyError(data), 'err');
     toast('Create failed', 'error');
     return;
   }
   const url = location.origin + '/' + (data.custom_slug || data.id);
-  showResult('<a href="' + url + '">' + url + '</a> <button class="btn btn-icon" id="result-copy" title="Copy URL" type="button">⧉</button>', false);
+  showResult('<a href="' + url + '">' + url + '</a> <button class="btn btn-icon" id="result-copy" title="Copy URL" type="button">⧉</button>', 'ok');
   $('result').dataset.token = data.deletion_token || '';
   const copyBtn = document.getElementById('result-copy');
   copyBtn.addEventListener('click', () => {
@@ -312,12 +339,12 @@ async function createCan() {
   const res = await fetch('/api/pastes/can', {method: 'POST', body: fd});
   const data = await res.json();
   if (!res.ok) {
-    showResult('Error: ' + (data.error || res.status), true);
+    showResult(friendlyError(data), 'err');
     toast('Can create failed', 'error');
     return;
   }
   const url = location.origin + data.url;
-  showResult('<a href="' + url + '">' + url + '</a> <button class="btn btn-icon" id="result-copy" title="Copy URL" type="button">⧉</button>', false);
+  showResult('<a href="' + url + '">' + url + '</a> <button class="btn btn-icon" id="result-copy" title="Copy URL" type="button">⧉</button>', 'ok');
   const copyBtn = document.getElementById('result-copy');
   copyBtn.addEventListener('click', () => {
     try {

internal/web/templates/settings.html

@@ -6,8 +6,55 @@
       <h1>Settings</h1>
     </div>
     <div class="settings-body">
-      <p>Settings are under construction.</p>
+      <h3>Theme</h3>
+      <div class="theme-grid" id="theme-grid"></div>
+      <p class="admin-link-row"><a class="admin-link" href="/admin">Admin</a></p>
     </div>
   </div>
 </div>
+<script>
+(function () {
+  // #112: derive each preset's swatches from the real CSS variables in
+  // app.css by temporarily applying data-preset, so they can never drift.
+  var themeNames = [
+    { id: 'midnight',        name: 'Midnight' },
+    { id: 'smooth',          name: 'Smooth' },
+    { id: 'pastel-lavender', name: 'Pastel Lavender' },
+    { id: 'pastel-peach',    name: 'Pastel Peach' },
+    { id: 'pastel-cloud',    name: 'Pastel Cloud' }
+  ];
+  var SWATCH_VARS = ['--bg', '--surface', '--surface-2', '--muted', '--accent'];
+
+  function presetColors(id) {
+    var root = document.documentElement;
+    var prev = root.getAttribute('data-preset');
+    root.setAttribute('data-preset', id);
+    var cs = getComputedStyle(root);
+    var colors = SWATCH_VARS.map(function (v) { return cs.getPropertyValue(v).trim(); });
+    if (prev === null) root.removeAttribute('data-preset'); else root.setAttribute('data-preset', prev);
+    return colors;
+  }
+
+  var grid = document.getElementById('theme-grid');
+  var current = document.documentElement.dataset.preset || 'midnight';
+  themeNames.forEach(function (t) {
+    var colors = presetColors(t.id);
+    var btn = document.createElement('button');
+    btn.type = 'button';
+    btn.className = 'theme-card';
+    btn.setAttribute('aria-pressed', current === t.id ? 'true' : 'false');
+    btn.innerHTML = '<strong>' + t.name + '</strong>' +
+      '<span class="swatches">' + colors.map(function (c) {
+        return '<span class="swatch" style="background:' + c + '"></span>';
+      }).join('') + '</span>';
+    btn.addEventListener('click', function () {
+      document.documentElement.dataset.preset = t.id;
+      try { localStorage.setItem('palette-theme', t.id); } catch (e) {}
+      grid.querySelectorAll('.theme-card').forEach(function (c) { c.setAttribute('aria-pressed', 'false'); });
+      btn.setAttribute('aria-pressed', 'true');
+    });
+    grid.appendChild(btn);
+  });
+})();
+</script>
 {{template "foot" .}}

internal/web/web.go

@@ -344,7 +344,7 @@ func SecurityHeaders(next http.Handler) http.Handler {
 		// is harmless and arguably desirable.
 		h := w.Header()
 		h.Set("Content-Security-Policy",
-			"default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'")
+			"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'")
 		h.Set("Referrer-Policy", "no-referrer")
 		h.Set("X-Content-Type-Options", "nosniff")
 		next.ServeHTTP(w, r)