feat: define secure static hosting contract

nginx.portfolio.conf.example

@@ -0,0 +1,42 @@
+# Replace every double-underscore placeholder before validation or deployment.
+# Generate the deployable file with scripts/generate-host-config.mjs; this file
+# intentionally contains no real production hostname, certificate path, or root.
+
+# Requires standard MIME mappings and static-file defaults in the parent Nginx http context.
+max_ranges 1;
+
+map $uri $portfolio_cache_control {
+  default "public, max-age=0, must-revalidate";
+  __EXACT_HASHED_ASSET_RULES__
+}
+
+server {
+  listen 80;
+  server_name __CANONICAL_HOST__ __ALTERNATE_HOSTS__;
+  return 308 https://__CANONICAL_HOST__$request_uri;
+}
+
+server {
+  listen 443 ssl;
+  server_name __CANONICAL_HOST__;
+  ssl_certificate __TLS_CERTIFICATE_PATH__;
+  ssl_certificate_key __TLS_KEY_PATH__;
+  ssl_protocols TLSv1.2 TLSv1.3;
+  root __DOCUMENT_ROOT__;
+  index index.html;
+
+  add_header Content-Security-Policy "default-src 'self'; script-src 'self' '__JSON_LD_CSP_HASH__'; style-src 'self'; img-src 'self' data:; media-src 'self'; font-src 'self'; connect-src 'none'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'; upgrade-insecure-requests" always;
+  add_header X-Content-Type-Options "nosniff" always;
+  add_header Referrer-Policy "no-referrer" always;
+  add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=(), accelerometer=(), gyroscope=(), magnetometer=()" always;
+  add_header X-Frame-Options "DENY" always;
+  add_header Cache-Control $portfolio_cache_control always;
+  add_header Strict-Transport-Security "max-age=31536000" always;
+
+  location = / { try_files /index.html =404; }
+  location = /index.html { try_files /index.html =404; }
+  location = /robots.txt { try_files /robots.txt =404; }
+  location = /sitemap.xml { try_files /sitemap.xml =404; }
+  location /assets/ { try_files $uri =404; }
+  location / { return 404; }
+}