fix(security): audit batch B — SPA CSP + vite upgrade (#21)

frontend/nginx.conf

@@ -4,6 +4,19 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    # AUDIT M-2: security headers on the SPA. script-src 'self' works because the theme
+    # bootstrap lives in /theme-init.js (no inline scripts); style-src needs 'unsafe-inline'
+    # for React/Chart.js/grid-layout inline style attributes (low risk with script-src locked).
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "DENY" always;
+    add_header Referrer-Policy "no-referrer" always;
+
+    # Compress the SPA bundle (AUDIT perf note: ~680 KB JS).
+    gzip on;
+    gzip_types text/css application/javascript application/json image/svg+xml;
+    gzip_min_length 1024;
+
     # SPA fallback.
     location / {
         try_files $uri $uri/ /index.html;