Harden the remote-config trust path (cert pinning, host allowlist, DoS guard)

[foodlbs]

Residual gaps from the 2026-07-10 security review (all pre-existing; the hardening batch closed backup injection, untaught-extra injection, and CI tag-hijack):

1. TLS certificate pinning (HIGH) — RemoteConfigSync.fetch() trusts the system store; a rogue CA (MDM/user-installed) can MITM a valid-TLS malicious config that redirects clicks within scoped apps. Pin raw.githubusercontent.com via network_security_config.xml, or sign the config payload (public key in-app) which also covers host compromise.
2. Hostname allowlist (MEDIUM) — the stored remote_config_url is only checked for https://. A compile-time allowed-host constant adds defense-in-depth (forks already edit the default-URL constant, so they'd edit this too).
3. Config DoS guard (MEDIUM) — a compromised host can ship enabled:false for every bundled app, silently disabling the whole service. Consider rejecting payloads that disable everything.

Config signing (item 1's stronger form) is also the prerequisite for delivering curated button sets and community configs more aggressively.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VSz5xqHNZDMi4ewUJwStnR