Harden production security: Dockerfile build, nginx whitelist, and CSP.

Replace Dokploy runtime git clone with Dockerfile build to keep tokens out of the container, add nginx security headers and path whitelist, and scrub templates from the running image after HTML generation.

Co-authored-by: Cursor <cursoragent@cursor.com>

Dockerfile

@@ -5,7 +5,8 @@ RUN apk add --no-cache gettext
 # Remove default nginx config
 RUN rm /etc/nginx/conf.d/default.conf
 
-# Copy nginx config from project root
+# Copy nginx configs from project root
+COPY nginx.conf /etc/nginx/nginx.conf
 COPY default.conf /etc/nginx/conf.d/default.conf
 
 # Copy static assets