feat: add security headers to caddyfile

Caddyfile

@@ -6,6 +6,12 @@
 :80 {
   encode zstd gzip
 
+  header {
+    X-Frame-Options "DENY"
+    X-Content-Type-Options "nosniff"
+    Referrer-Policy "strict-origin-when-cross-origin"
+  }
+
   handle /mcp {
     reverse_proxy 127.0.0.1:3001
   }

src/client/components/EditorCanvas.tsx

@@ -28,7 +28,8 @@ function sceneFromEditor(
   files: BinaryFiles,
 ): ScenePayload {
   return {
-    elements: [...elements],
+    // Excalidraw passes immutable arrays, avoid copying it on every onChange event
+    elements: elements as unknown[],
     appState: appState as unknown as Record<string, unknown>,
     files: files as unknown as Record<string, unknown>,
   };

src/client/hooks/useThemeTokenSync.ts

@@ -33,10 +33,20 @@ export function useThemeTokenSync(
       return;
     }
 
+    // Read all tokens first to avoid layout thrashing
     const computedStyles = window.getComputedStyle(excalidrawRoot);
+    const updates: Array<[string, string]> = [];
+
     for (const [sourceToken, targetToken] of EXCALIDRAW_THEME_TOKEN_MAP) {
       const value = computedStyles.getPropertyValue(sourceToken).trim();
       if (value) {
+        updates.push([targetToken, value]);
+      }
+    }
+
+    // Write in a separate pass, skipping unchanged values
+    for (const [targetToken, value] of updates) {
+      if (appShell.style.getPropertyValue(targetToken) !== value) {
         appShell.style.setProperty(targetToken, value);
       }
     }