Bump pdf.js past CVE-2024-4367; tighten img-src; fix heading order

_headers

@@ -11,7 +11,7 @@
   # font options load on demand: Atkinson Hyperlegible (CSS from
   # fonts.googleapis.com, files from fonts.gstatic.com) and OpenDyslexic
   # (CSS + files from fonts.cdnfonts.com). Only fetched when a user opts in.
-  Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; script-src-elem 'self' https://cdn.jsdelivr.net; worker-src 'self' blob:; img-src 'self' data: blob: https:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.cdnfonts.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.cdnfonts.com; connect-src 'self' https://cdn.jsdelivr.net https://*.supabase.co https://api.web3forms.com; frame-ancestors 'none'; base-uri 'none'; object-src 'none'; form-action 'none'; upgrade-insecure-requests
+  Content-Security-Policy: default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; script-src-elem 'self' https://cdn.jsdelivr.net; worker-src 'self' blob:; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.cdnfonts.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.cdnfonts.com; connect-src 'self' https://cdn.jsdelivr.net https://*.supabase.co https://api.web3forms.com; frame-ancestors 'none'; base-uri 'none'; object-src 'none'; form-action 'none'; upgrade-insecure-requests
   # Force HTTPS for a year, cover subdomains, and allow preloading — matches
   # the fleet baseline used by the sibling companion apps. Cloudflare Pages
   # already serves HTTPS-only; this makes the browser refuse any downgrade.

app.js

@@ -1760,7 +1760,7 @@ function renderQuizResults() {
 
   const wrongHTML = wrong.length === 0 ? '' : `
     <div class="quiz-missed">
-      <h3 class="quiz-missed-title">Missed (${wrong.length})</h3>
+      <h2 class="quiz-missed-title">Missed (${wrong.length})</h2>
       <ul class="quiz-missed-list">
         ${wrong.map(bq => {
           const q = getQuestion(bq);
@@ -1778,7 +1778,7 @@ function renderQuizResults() {
   // report style so the user knows which domain to focus next pass.
   const objHTML = !mock || objBreakdown.length === 0 ? '' : `
     <div class="mock-obj-breakdown">
-      <h3 class="mock-obj-title">By objective</h3>
+      <h2 class="mock-obj-title">By objective</h2>
       <ul class="mock-obj-list">
         ${objBreakdown.map(([obj, b]) => {
           const pct = Math.round((b.correct / b.total) * 100);
@@ -3284,8 +3284,8 @@ async function loadPdfJs() {
   if (_pdfjsModule) return _pdfjsModule;
   // Fixed pinned version, ESM build. The first load lands in the SW
   // cache so subsequent loads are offline.
-  const url = 'https://cdn.jsdelivr.net/npm/pdfjs-dist@4.0.379/build/pdf.min.mjs';
-  const workerUrl = 'https://cdn.jsdelivr.net/npm/pdfjs-dist@4.0.379/build/pdf.worker.min.mjs';
+  const url = 'https://cdn.jsdelivr.net/npm/pdfjs-dist@4.2.67/build/pdf.min.mjs';
+  const workerUrl = 'https://cdn.jsdelivr.net/npm/pdfjs-dist@4.2.67/build/pdf.worker.min.mjs';
   const mod = await import(/* @vite-ignore */ url);
   mod.GlobalWorkerOptions.workerSrc = workerUrl;
   _pdfjsModule = mod;

index.html

@@ -7,7 +7,7 @@
        including frame-ancestors / upgrade-insecure-requests, which aren't
        valid in a meta tag). Mirrors _headers so the concept-fixes raw-HTML
        render path stays backstopped even off Cloudflare. -->
-  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; worker-src 'self' blob:; img-src 'self' data: blob: https:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.cdnfonts.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.cdnfonts.com; connect-src 'self' https://cdn.jsdelivr.net https://*.supabase.co https://api.web3forms.com; base-uri 'none'; object-src 'none'; form-action 'none'">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' https://cdn.jsdelivr.net; worker-src 'self' blob:; img-src 'self' data: blob:; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://fonts.cdnfonts.com; font-src 'self' data: https://fonts.gstatic.com https://fonts.cdnfonts.com; connect-src 'self' https://cdn.jsdelivr.net https://*.supabase.co https://api.web3forms.com; base-uri 'none'; object-src 'none'; form-action 'none'">
   <meta name="viewport" content="width=device-width, initial-scale=1.0, viewport-fit=cover">
   <!-- Cross-platform PWA install (Android Chrome / Edge / desktop). -->
   <meta name="mobile-web-app-capable" content="yes">

sw.js

@@ -1,5 +1,5 @@
 // Service worker — cache shell + content for offline use
-const CACHE = 'aplus-study-v126';
+const CACHE = 'aplus-study-v127';
 const ASSETS = [
   './',
   './index.html',