fix: ensure that no assets (including og links) ever fetch from external sources

AGENTS.md

@@ -16,6 +16,10 @@ Rationale: hard-wrapped prose produces noisy diffs when sentences are edited and
 
 After creating or modifying any `.sas` files, run `sasjs lint` from the `sas/` directory and ensure the files you touched have no lint warnings (the repo currently has pre-existing warnings in other files, which can be ignored).
 
+## No external assets
+
+Data Controller must run entirely locally (offline / on-prem, no internet access). The built product must never fetch assets from remote servers — no external fonts, images, scripts, stylesheets, CDN links, or remote URLs in meta tags (e.g. `og:image`, `og:url`, `itemprop="image"`). All assets must be bundled and served locally.
+
 ## The .agent folder
 
 Agent-related content lives in `.agent/`: technical/agent-facing documentation goes in `.agent/docs/` (not `docs/`), and skills in `.agent/skills/`. When writing explanatory or technical docs about the codebase, put them in `.agent/docs/`.

client/src/index.html

@@ -15,21 +15,18 @@
     -->
 
     <!-- meta tags -->
+    <!--
+      NOTE: Data Controller must run entirely offline / on-prem. Never reference
+      external assets (fonts, images, scripts, styles, CDN links, or remote
+      og:/itemprop URLs) here or anywhere in the built product. All assets must
+      be bundled and served locally.
+    -->
     <meta name="description" content="Capture, Review, and Approve" />
     <meta itemprop="name" content="Data Controller for SAS®" />
     <meta itemprop="description" content="Capture, Review, and Approve" />
-    <meta
-      itemprop="image"
-      content="https://docs.datacontroller.io/img/dc_bg_Asset-5@2x.png"
-    />
-    <meta property="og:url" content="http://demo.datacontroller.io" />
     <meta property="og:type" content="website" />
     <meta property="og:title" content="Data Controller for SAS®" />
     <meta property="og:description" content="Capture, Review, and Approve" />
-    <meta
-      property="og:image"
-      content="https://docs.datacontroller.io/img/dc_bg_Asset-5@2x.png"
-    />
 
     <meta name="viewport" content="width=device-width, initial-scale=1" />
     <meta http-equiv="X-UA-Compatible" content="IE=edge" />
@@ -54,7 +51,7 @@
 
   <sasjs
     serverUrl=""
-    appLoc="/Public/app/devtest"
+    appLoc="/Public/app/dc"
     serverType="SASJS"
     loginMechanism="Redirected"
     debug="false"