Release 0.2.0

Author: commjoen

CI_TEST_FIXES.md .cursor/fixes/CI_TEST_FIXES.mdCI_TEST_FIXES.md renamed to .cursor/fixes/CI_TEST_FIXES.md

@@ -36,10 +36,10 @@ Private experiment to create a game with cursor. Play it for free at https://com
    ```
 3. To enable multiplayer in development, run both the dev server and the multiplayer server:
    ```sh
-   # In one terminal:
-   npm run dev:mp
    # In another terminal:
    node server.js
+   # In one terminal:
+   npm run dev:mp
    ```
    Open two browser windows at the shown URL (usually http://localhost:5173) to test multiplayer.
 4. If you see TypeScript errors about `import.meta.env`, ensure you have this line in `src/vite-env.d.ts`:
@@ -141,7 +141,7 @@ docker pull ghcr.io/commjoen/generated-game-experiment:latest
 docker pull ghcr.io/commjoen/generated-game-experiment:pr-123
 
 # Specific release
-docker pull ghcr.io/commjoen/generated-game-experiment:v1.0.0
+docker pull ghcr.io/commjoen/generated-game-experiment:v0.2.0
 ```
 
 ### PR Workflow

DOCKER_CI_CD.md .cursor/fixes/DOCKER_CI_CD.mdDOCKER_CI_CD.md renamed to .cursor/fixes/DOCKER_CI_CD.md

@@ -21,7 +21,7 @@ http {
             add_header X-Frame-Options "SAMEORIGIN" always;
             add_header X-Content-Type-Options "nosniff" always;
             add_header Referrer-Policy "strict-origin-when-cross-origin" always;
-            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data: ws: wss:; connect-src 'self' http://$host:3001/health ws://$host:3001 wss://$host:3001 http://$host:3001;" always;
+            add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' https://pixabay.com data:; font-src 'self' data: ws: wss:; connect-src 'self' https://pixabay.com http://$host:3001/health ws://$host:3001 wss://$host:3001 http://$host:3001;" always;
             # Uncomment if serving over HTTPS
             # add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
         }