chore(hardening): tighten security and footprint defaults

src-tauri/src/commands/security.rs

@@ -0,0 +1,30 @@
+pub fn ensure_main_window(window: &tauri::WebviewWindow) -> Result<(), String> {
+    ensure_main_window_label(window.label())
+}
+
+pub fn ensure_main_window_label(label: &str) -> Result<(), String> {
+    if label == "main" {
+        Ok(())
+    } else {
+        Err(format!(
+            "This command is only available from the main window (got {label})."
+        ))
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::ensure_main_window_label;
+
+    #[test]
+    fn accepts_main_window() {
+        assert!(ensure_main_window_label("main").is_ok());
+    }
+
+    #[test]
+    fn rejects_secondary_windows() {
+        for label in ["tasks-float", "transcript-viewer", "transcription-preview"] {
+            assert!(ensure_main_window_label(label).is_err());
+        }
+    }
+}