Migrate to env-driven templates and slavic-pulse feature set.

Replace hardcoded HTML with .env generation, YouTube thumbnail backgrounds, responsive FHD/vertical intro, hardened nginx, and updated Dokploy deploy flow.

Co-authored-by: Cursor <cursoragent@cursor.com>

default.conf

@@ -10,9 +10,24 @@ server {
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml image/svg+xml;
     gzip_min_length 1024;
 
+    # Block hidden files and sensitive extensions
+    location ~ /\. {
+        deny all;
+        return 404;
+    }
+
+    location ~* \.(sh|template|env|yml|yaml|md|git|bak|sql|log)$ {
+        deny all;
+        return 404;
+    }
+
     # Main page
-    location / {
-        try_files $uri $uri/ /index.html;
+    location = / {
+        try_files /index.html =404;
+    }
+
+    location = /index.html {
+        add_header Cache-Control "no-cache";
     }
 
     # Web app manifest
@@ -29,7 +44,15 @@ server {
         try_files $uri =404;
     }
 
+    # Everything else → 404 (no fallback to index.html)
+    location / {
+        return 404;
+    }
+
     # Security headers
     add_header X-Frame-Options SAMEORIGIN always;
     add_header X-Content-Type-Options nosniff always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;
+    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://www.youtube.com https://www.gstatic.com; style-src 'self' 'unsafe-inline'; img-src 'self' https://img.youtube.com data:; frame-src https://www.youtube.com; connect-src 'self' https://www.youtube.com; base-uri 'self'; form-action 'none'; object-src 'none'; upgrade-insecure-requests;" always;
 }