Hub proxy: don't relay a node's policy headers on top of the hub's own

Access-Control-Allow-Origin arrived twice on /api/nodes/<m>/sensors, which a
browser on another origin refuses. Also: demo lists say when the token hides them.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

internal/nodes/nodes.go

@@ -442,6 +442,15 @@ func (m *Manager) Proxy(name string) (http.Handler, bool) {
 		},
 		Transport:     transportFor(n),
 		FlushInterval: -1, // stream task output / log tails immediately
+		// The node answers with its own policy headers and this hub adds the same ones to
+		// everything it serves; relayed twice, Access-Control-Allow-Origin is invalid and a
+		// browser on another origin refuses the response. The hub's copy is the one that counts.
+		ModifyResponse: func(resp *http.Response) error {
+			for _, h := range []string{"Access-Control-Allow-Origin", "X-Frame-Options", "Content-Security-Policy", "X-Content-Type-Options", "Referrer-Policy"} {
+				resp.Header.Del(h)
+			}
+			return nil
+		},
 		ErrorHandler: func(w http.ResponseWriter, r *http.Request, err error) {
 			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusBadGateway)