feat(security): add a report-only CSP and security headers

nginx.conf is now an nginx template, so connect-src takes
AUTH_HOST and API_HOST from the container env. The image
sets both to empty by default, so nginx still starts
without them. Report-only until production shows no
violation. Also nosniff, Referrer-Policy and
Permissions-Policy.

README.md

@@ -46,7 +46,8 @@ To Be Played is split into three repositories:
 - Tailwind CSS 4, Radix UI primitives (shadcn/ui style components), Lucide icons
 - react-hook-form + zod for forms, i18next for translations (`public/i18n`)
 - Vitest + React Testing Library + jsdom
-- Production image: nginx (Alpine), SPA fallback and long-term caching for hashed assets
+- Production image: nginx (Alpine), SPA fallback, long-term caching for hashed assets, Content Security Policy
+  (report-only for now) and security headers
 - CI: Forgejo Actions (`npm ci`, `npm test`, `npm run build`, Docker image)
 
 ## Project structure
@@ -90,7 +91,7 @@ npm run build
 ## Roadmap
 
 - Mood filter for "What to play next".
-- A Content Security Policy in `nginx.conf`.
+- Enforce the Content Security Policy (it runs in report-only mode now).
 
 ## License