Import and prepare the Webflow app for Simple Analytics hosting

[simple-analytics-ai]

Requires https://github.com/simpleanalytics/infrastructure/pull/275 to be merged and provisioned first, including the Webflow client secret and running Redis. Then merge this PR: its main workflow builds the image and deploys the backend on esapp04.

Summary

Fixes #2. Release tracked in #1.

Import the commissioned source and prepare it to run on Simple Analytics infrastructure, as requested by Adriaan. The first commit preserves the contractor delivery from 05c638ff6a9c6c1455a8819ea8cfdd04136933bc; the follow-up replaces Upstash with private Redis, adds a non-root standalone Docker image, and uses the existing GHCR/replace-webhook deployment workflow. The extension now connects to https://webflow.simpleanalytics.com.

Before this change a session selected a user-wide token and accepted an arbitrary site ID. Sessions now contain only a user ID and the site verified by Webflow, and every script operation checks that site boundary. OAuth uses an expiring, single-use browser-bound state. Health checks return 503 on missing configuration or Redis failure without disclosing connection details. Script configuration strings are safely serialized, disabled automatic events stay disabled, and removed scripts no longer show as installed.

Security implications

• No security impact
• Has security impact: fixes cross-site authorization, adds OAuth state verification, retains AES-256-GCM encryption for stored tokens, removes personal information from sessions/logs, and restricts runtime CORS to the configured extension origin. Redis is private in the companion infrastructure change. No credentials are committed.

Next.js is updated to 16.3.8 with React 19 and the runtime proxy convention; Vite is updated to 7.3.7. Migration guides were checked and production builds verified. The root and extension npm audits report zero vulnerabilities. The backend audit reports five low-severity entries in the Webflow SDK's elliptic dependency chain; the current SDK 3.3.4 has no patched release for that chain. There are no remaining moderate/high/critical npm findings. Extension packaging writes the standard ZIP (built assets plus webflow.json) without adding the unrelated Webflow Cloud CLI dependency tree.

Testing

• Seven deterministic security checks pass: encrypted token integrity, site isolation, session expiry/signature, Webflow resolved-site verification, OAuth state rejection, script escaping/disabled-event behavior, and removed-script status.
• Clean-install backend and extension lint/typecheck/production builds pass after refreshing main.
• Docker production build passes. A non-root, read-only container passed health, unauthorized API, CORS and OAuth initiation checks; Redis stop returned 503 and restart restored service.
• New CI repeats security/lint/build checks and container smoke checks, and uploads the production extension ZIP. GitHub CI passed on d555e3e, including the container smoke checks.
• Verified the generated extension ZIP contains the Simple Analytics backend URL and no contractor Vercel URL. Live Webflow install/apply/remove still requires the production secret, app settings, and approved deployment.

Webflow setup after deployment

In the Simple Analytics app at https://webflow.com/dashboard/workspace/simple-analytics-workspace/app-development:

• Redirect URI: https://webflow.simpleanalytics.com/api/auth/callback.
• Install URL for the Marketplace submission: https://webflow.simpleanalytics.com/api/auth/authorize (this sets OAuth state before redirecting to Webflow).
• Scopes: Sites read, Custom Code read/write, Authorized User read.
• Upload webflow-extension / bundle.zip from the successful main workflow, test on a Webflow site, then submit for Marketplace review.

The repository also needs access to the organization DEPLOY_TOKEN secret used by the shared deployment workflow. Broker access cannot enumerate Actions secrets (HTTP 403), so that access has not been confirmed.

Checklist

• Linked to an issue
• Tested
• Asked for a review