fix: show autosave failures

.jules/sentinel.md

@@ -1,5 +0,0 @@
-## 2025-06-07 - [Added Security Headers via Caddy]
-
-**Vulnerability:** Missing HTTP security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy).
-**Learning:** The application does not apply security headers in the Bun application server but instead relies on the Caddy reverse proxy to inject them in the `Caddyfile`.
-**Prevention:** Always configure security headers at the reverse proxy level (`Caddyfile`) instead of within the backend API routing code to ensure all routes, including static files, are properly protected.

Caddyfile

@@ -6,12 +6,6 @@
 :80 {
   encode zstd gzip
 
-  header {
-    X-Frame-Options "SAMEORIGIN"
-    X-Content-Type-Options "nosniff"
-    Referrer-Policy "strict-origin-when-cross-origin"
-  }
-
   handle /mcp {
     reverse_proxy 127.0.0.1:3001
   }

src/client/hooks/useDrawingSession.ts

@@ -231,6 +231,8 @@ export function useDrawingSession() {
           }
           if (isManual) {
             showToast("Saved", 2000);
+          } else {
+            showToast(null);
           }
         })
         .catch((saveError: unknown) => {
@@ -251,6 +253,8 @@ export function useDrawingSession() {
           );
           if (isManual) {
             showToast("Save failed", 2000);
+          } else {
+            showToast("Autosave failed");
           }
           throw saveError;
         })

src/server/http-server.tsx

@@ -12,6 +12,7 @@ export function createServer(options: CreateServerOptions = {}) {
   return {
     port: Number(process.env.PORT ?? "3000"),
     hostname: process.env.HOST ?? "localhost",
+    idleTimeout: 120,
     routes: {
       "/": (request: Request) => {
         const drawing = drawingStore.ensureInitialDrawing();