feat(security): add a report-only CSP and security headers

nginx.conf is now an nginx template, so connect-src takes
AUTH_HOST and API_HOST from the container env. The image
sets both to empty by default, so nginx still starts
without them. Report-only until production shows no
violation. Also nosniff, Referrer-Policy and
Permissions-Policy.

Dockerfile

@@ -9,6 +9,8 @@ RUN npm run build
 # Serve the static files using a lightweight web server
 FROM nginx:alpine
 COPY --from=builder /app/dist /usr/share/nginx/html
-COPY nginx.conf /etc/nginx/conf.d/default.conf
+# nginx.conf is a template. An env var that is not set stays in it as ${...}, and nginx then fails to start.
+ENV AUTH_HOST="" API_HOST=""
+COPY nginx.conf /etc/nginx/templates/default.conf.template
 EXPOSE 80
 CMD ["nginx", "-g", "daemon off;"]