Harden production security: Dockerfile build, nginx whitelist, and CSP.

Replace Dokploy runtime git clone with Dockerfile build to keep tokens out of the container, add nginx security headers and path whitelist, and scrub templates from the running image after HTML generation.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose-example/docker-compose.yml

@@ -5,13 +5,15 @@
 # W UI Dokploy ustaw domenę i Container Port = 80 — Traefik routuje po FQDN.
 # Wewnętrznie nginx nasłuchuje na :80 (expose poniżej).
 #
-# Runtime git clone — repozytorium musi być publiczne LUB ustaw GITEA_REPO_URL w .env
-# (patrz README — prywatne repo bez tokenu = exit 128, restart loop).
+# Build z Dockerfile — Dokploy klonuje repo na hoście i buduje obraz.
+# Brak runtime git clone w kontenerze (hardening bezpieczeństwa).
 # ============================================================
 
 services:
   frontend:
-    image: nginx:1.27-alpine
+    build:
+      context: ..
+      dockerfile: Dockerfile
     container_name: slavic-pulse-com-frontend
     restart: unless-stopped
 
@@ -21,30 +23,12 @@ services:
     env_file:
       - .env
 
-    command: >
-      sh -ce "
-        echo '[slavic-pulse] Installing git + gettext...' &&
-        apk add --no-cache git gettext &&
-        echo '[slavic-pulse] Cloning repo...' &&
-        rm -rf /app &&
-        git clone --depth 1 \"$${GITEA_REPO_URL:-https://gitea.expert-it.agency-ai.dev/tomasz-syn-grzegorza/site-slavic-pulse-com.git}\" /app &&
-        echo '[slavic-pulse] Generating index.html from .env...' &&
-        chmod +x /app/generate-from-env.sh &&
-        TEMPLATE_DIR=/app /app/generate-from-env.sh /usr/share/nginx/html &&
-        echo '[slavic-pulse] Copying assets and nginx config...' &&
-        cp -r /app/assets /usr/share/nginx/html/assets &&
-        rm -f /etc/nginx/conf.d/default.conf &&
-        cp /app/default.conf /etc/nginx/conf.d/default.conf &&
-        echo '[slavic-pulse] Starting nginx...' &&
-        nginx -g 'daemon off;'
-      "
-
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://127.0.0.1:80/"]
       interval: 30s
       timeout: 10s
       retries: 3
-      start_period: 60s
+      start_period: 15s
 
     deploy:
       resources: