fix(launch): close waitlist RLS bypass + open email relay + add security headers

Launch-critical fixes for the public July-14 signup surface (swarm-audited by
MiniMax M3, Claude-verified against the frontend RPC call path):
- migration: DROP the "anon can insert with check(true)" RLS policy. It let
  anon write arbitrary rows straight to the table, bypassing all join_waitlist
  validation. The frontend already calls the join_waitlist RPC (rest/v1/rpc/),
  never a direct insert, so signup is unaffected. RLS stays enabled with no
  permissive INSERT policy = direct anon inserts denied by default.
- join_waitlist: cap email <=254, reject control chars, truncate referrer <=2048.
- waitlist-welcome edge fn: FAIL CLOSED — if WAITLIST_WEBHOOK_SECRET is unset,
  return 401 instead of serving (was an open Resend relay). Guard the referral
  code against ^[a-z2-9]{7}$ and cap email length before sending.
- vercel.json: add baseline security headers (nosniff, Referrer-Policy,
  X-Frame-Options: DENY, HSTS, Permissions-Policy). CSP deferred (would break
  the WebGPU hero's inline bootstrap without nonces) — documented.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

supabase/functions/waitlist-welcome/index.ts

@@ -77,9 +77,18 @@ function buildEmail(link: string, xIntent: string) {
 }
 
 Deno.serve(async (req) => {
-  // optional shared-secret check
+  // Mandatory shared-secret check (fail closed). If WAITLIST_WEBHOOK_SECRET is
+  // not configured, refuse to serve — an unauthenticated, internet-reachable
+  // function that sends Resend email is an open relay / abuse vector.
   const expected = Deno.env.get("WAITLIST_WEBHOOK_SECRET");
-  if (expected && req.headers.get("x-webhook-secret") !== expected) {
+  if (!expected) {
+    console.error("WAITLIST_WEBHOOK_SECRET not set; refusing to serve");
+    return new Response(JSON.stringify({ ok: false, error: "unauthorized" }), {
+      status: 401,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+  if (req.headers.get("x-webhook-secret") !== expected) {
     return new Response(JSON.stringify({ ok: false, error: "unauthorized" }), {
       status: 401,
       headers: { "Content-Type": "application/json" },
@@ -106,6 +115,25 @@ Deno.serve(async (req) => {
     });
   }
 
+  // Validate inputs before they reach the email HTML / Resend. The referral
+  // code is interpolated into HTML and a share URL, so constrain it to the
+  // generator's charset (gen_referral_code: [a-z2-9], 7 chars). Cap the email
+  // length so an oversized address can't be passed to Resend. Both fields are
+  // already validated upstream by join_waitlist; this is defense in depth in
+  // case the webhook payload is spoofed or the schema drifts.
+  if (!/^[a-z2-9]{7}$/.test(code)) {
+    return new Response(JSON.stringify({ ok: true, skipped: "bad code" }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+  if (email.length > 254) {
+    return new Response(JSON.stringify({ ok: true, skipped: "bad email" }), {
+      status: 200,
+      headers: { "Content-Type": "application/json" },
+    });
+  }
+
   const key = Deno.env.get("RESEND_API_KEY");
   if (!key) {
     // Email is optional infra — capture already succeeded. Ack with a note.