nginx: security headers on every response (closes #18)

nginx sent none of the security headers REPO_POLICIES.md requires.
security-headers.conf now sets all six with always, included at server
level and again in /assets/, whose own add_header would otherwise drop
them. nginx hides the copies netwatch-server sets, so /api/ and the
health check carry each header once. The content security policy
allows no inline script or style; the host row's status dot took its
grey from a style attribute, now a class. connect-src is * because
several probed hosts redirect to other hosts and the browser checks
every redirect against it. Referrer-Policy is no-referrer, as the
backend already sends.

Model: opus-5-5

README.md

@@ -188,6 +188,8 @@ only inside the container, on `127.0.0.1:8081`. The image:
   reverse proxies named in `TRUSTED_PROXIES`, and by default from none
 - Sends access logs to stdout
 - Caches static assets with immutable headers
+- Sends the security headers `REPO_POLICIES.md` requires on every response, as
+  `security-headers.conf` sets them, in place of the backend's own
 - Stores reports in `DATA_DIR`, `/data/reports` by default, on the `/data`
   volume. The backend runs as user `netwatch` (uid 1000), so a directory
   bind-mounted at `/data` must be writable by uid 1000