Optimizations for the Website service (#9)

This PR contains the work done to provide optimizations to the current service, such as a health-check endpoint, pre-renders static HTML pages, and hardens the error page's CSP.

To provide further details about the work:

* Added the `HealthController` controller serving GET `/health` with a static JSON payload.
* Added the `CachedHTMLResponse` response, which renders a static HTMLDocument to bytes once and reuses them per request (no Content-Length, so responses stay compressible).
* Integrated the response into the `RootController` and the  `NotFoundMiddleware` middleware to avoid re-rendering on hot paths.
* Added a `RouterMethods.addRoutes(_:)` extension and switched the router in App+build to use it.
* Moved the inline style from the `ErrorPage` page into a dedicated style file so the CSP needs no inline-style escape hatch.
* Fixed the `IndexPage` page path inconsistencies.
* Written the `README` file.

Reviewed-on: rock-n-code/loud-amsterdam#9
Co-authored-by: Javier Cicchelli <javier@rock-n-code.com>
Co-committed-by: Javier Cicchelli <javier@rock-n-code.com>

Services/Website/Sources/Library/Public/Extensions/RouterMethods+RouteCollections.swift

@@ -0,0 +1,80 @@
+import Hummingbird
+
+/// A result builder that collects ``RouteCollection`` values into a stack.
+///
+/// Mirrors the `MiddlewareFixedTypeBuilder` Hummingbird uses for `addMiddleware`, letting route
+/// collections be listed declaratively rather than added one statement at a time.
+@resultBuilder
+public enum RouteCollectionBuilder<Context: RequestContext> {
+
+    public static func buildExpression(
+        _ collection: RouteCollection<Context>
+    ) -> [RouteCollection<Context>] {
+        [collection]
+    }
+
+    public static func buildBlock(
+        _ collections: [RouteCollection<Context>]...
+    ) -> [RouteCollection<Context>] {
+        collections.flatMap { $0 }
+    }
+
+    public static func buildOptional(
+        _ collections: [RouteCollection<Context>]?
+    ) -> [RouteCollection<Context>] {
+        collections ?? []
+    }
+
+    public static func buildEither(
+        first collections: [RouteCollection<Context>]
+    ) -> [RouteCollection<Context>] {
+        collections
+    }
+
+    public static func buildEither(
+        second collections: [RouteCollection<Context>]
+    ) -> [RouteCollection<Context>] {
+        collections
+    }
+
+    public static func buildArray(
+        _ collections: [[RouteCollection<Context>]]
+    ) -> [RouteCollection<Context>] {
+        collections.flatMap { $0 }
+    }
+
+}
+
+// MARK: - Helpers
+
+public extension RouterMethods {
+
+    // MARK: Methods
+
+    /// Adds route collections to the router using the ``RouteCollectionBuilder`` result builder.
+    ///
+    /// Mirrors `addMiddleware`, letting controllers be listed declaratively:
+    ///
+    /// ```swift
+    /// router.addRoutes {
+    ///     RootController<AppRequestContext>().routes
+    ///     HealthController<AppRequestContext>().routes
+    /// }
+    /// ```
+    ///
+    /// Each collection is added at the router's root, exactly as a sequence of
+    /// `addRoutes(_:)` calls would.
+    /// - Parameter build: the route-collection stack result builder.
+    /// - Returns: the router, so calls can be chained.
+    @discardableResult
+    func addRoutes(
+        @RouteCollectionBuilder<Context> _ build: () -> [RouteCollection<Context>]
+    ) -> Self {
+        for collection in build() {
+            addRoutes(collection)
+        }
+
+        return self
+    }
+
+}

Services/Website/Sources/Library/Public/Extensions/String+Constants.swift

@@ -11,10 +11,11 @@ extension String {
     public enum Security {
         /// The default `Content-Security-Policy`.
         ///
-        /// Restricts every resource to the site's own origin. `style-src` additionally allows
-        /// `'unsafe-inline'` because ``ErrorPage`` ships an inline `<style>` block; remove it once
-        /// the error page's styles move to an external stylesheet.
-        public static let contentSecurityPolicy = "default-src 'self'; style-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
+        /// Restricts every resource to the site's own origin (`default-src 'self'`), blocks plugins
+        /// (`object-src 'none'`), pins the document base URL (`base-uri 'self'`), and forbids framing
+        /// (`frame-ancestors 'none'`). Both pages link external stylesheets, so no inline-style
+        /// exception is required.
+        public static let contentSecurityPolicy = "default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
         /// The default `X-Content-Type-Options` (disables MIME sniffing).
         public static let contentTypeOptions = "nosniff"
         /// The default `X-Frame-Options` (forbids framing the page).