Move to the layout REPO_POLICIES.md gives (closes #30)

The Go module moves from backend/ to the root (go.mod, go.sum,
.golangci.yml, cmd/, internal/), the page's source to web/, and nginx's
two files to configs/. backend/ is gone: its LICENSE and .dockerignore
are deleted, and its .gitignore entries, README and scripts are folded
into the root ones. script/build builds the server binary after the
frontend; script/run and script/clean move up from backend/script/;
make test, lint, fmt and fmt-check do what the backend's did. Vite's
root is web/ and it still builds into dist/. go.mod ignores
node_modules/, whose npm packages can ship .go files. script/bootstrap
no longer installs gcc, which only the host Go tests needed.

Model: opus-5-5

configs/nginx.conf

@@ -0,0 +1,77 @@
+# A template: the nginx image renders it into conf.d at container start,
+# filling in PORT and nothing else. bin/entrypoint.sh sets PORT and that
+# limit.
+server {
+    listen ${PORT};
+    server_name _;
+
+    # Keep the nginx version out of the Server header and error pages.
+    server_tokens off;
+
+    # The security headers, on every response. An add_header in a
+    # location drops every add_header from here, so a location with one
+    # of its own includes this file again.
+    include /etc/nginx/security-headers.conf;
+
+    root /usr/share/nginx/html;
+    index index.html;
+
+    # The client address comes from X-Forwarded-For only on a request
+    # from the reverse proxies in TRUSTED_PROXIES: bin/entrypoint.sh
+    # writes one set_real_ip_from line for each into this file, and
+    # leaves it empty when TRUSTED_PROXIES is unset, so that by default
+    # the client address is the one each request comes from.
+    include /etc/nginx/trusted-proxies.conf;
+    real_ip_header X-Forwarded-For;
+    real_ip_recursive on;
+
+    # Access log to stdout (Docker best practice)
+    access_log /dev/stdout combined;
+    error_log  /dev/stderr warn;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+    }
+
+    # Cache static assets aggressively
+    location /assets/ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+        include /etc/nginx/security-headers.conf;
+    }
+
+    # netwatch-server, the Go backend, runs in the same container and
+    # listens on loopback only: bin/entrypoint.sh starts it on
+    # 127.0.0.1:8081. These headers go with every request passed to it.
+    # X-Forwarded-For carries only the client address, as resolved by
+    # the real IP settings above, and not the chain the request came
+    # with: the backend takes the first entry, which a client can write.
+    proxy_set_header Host $host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $remote_addr;
+    proxy_set_header X-Forwarded-Proto $scheme;
+
+    # netwatch-server sets the same security headers on its own
+    # responses. Its copies are dropped so that each header goes out
+    # once, as configs/security-headers.conf sets it.
+    proxy_hide_header Strict-Transport-Security;
+    proxy_hide_header Content-Security-Policy;
+    proxy_hide_header X-Frame-Options;
+    proxy_hide_header X-Content-Type-Options;
+    proxy_hide_header Referrer-Policy;
+    proxy_hide_header Permissions-Policy;
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:8081;
+    }
+
+    location = /.well-known/healthcheck {
+        proxy_pass http://127.0.0.1:8081;
+    }
+
+    # The backend's Prometheus metrics, behind its own basic auth. Unless
+    # METRICS_USERNAME and METRICS_PASSWORD are set, it answers 404.
+    location = /metrics {
+        proxy_pass http://127.0.0.1:8081;
+    }
+}

configs/security-headers.conf

@@ -0,0 +1,24 @@
+# The security headers REPO_POLICIES.md requires on every response.
+# configs/nginx.conf includes this file, which Dockerfile copies to
+# /etc/nginx/security-headers.conf. always sends each header on error
+# responses too.
+
+add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+# Scripts and styles load only from the page's own origin. Inline ones
+# are blocked, style attributes in markup included, so style elements
+# through classes or element.style. data: images are for the favicon
+# in web/index.html. connect-src is * because the browser checks each
+# probe in web/src/main.js against it, and also every redirect the probe
+# follows, and several of those hosts redirect to others; a list of
+# hosts here would block those probes. It also covers the reports the
+# page sends to its own origin.
+add_header Content-Security-Policy "default-src 'self'; connect-src *; img-src 'self' data:; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'" always;
+
+add_header X-Frame-Options DENY always;
+add_header X-Content-Type-Options nosniff always;
+
+# The probed hosts are not told where the page is served from.
+add_header Referrer-Policy no-referrer always;
+
+add_header Permissions-Policy "accelerometer=(), camera=(), display-capture=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), usb=()" always;