security(nginx): block access to sensitive files and directories

Added comprehensive security rules to all nginx configurations:

Dev proxy (nginx/conf.d/default.conf):
- Block dotfiles and .git directory
- Block .env* files and config files
- Block node_modules, docker configs, package files
- Block backup files (.bak, .swp, ~)

Prod proxy (nginx/conf.d.prod/default.conf):
- All dev security rules
- Added security headers (X-Frame-Options, CSP, etc.)
- Strict CSP with frame-ancestors 'none'

Frontend container (frontend/nginx.conf):
- Block dotfiles and sensitive config files
- Block node_modules and build configs
- Added security headers

All blocked paths return 404 and disable logging to avoid log spam.

Blocks: .env*, .git, node_modules, docker*, package*.json,
prisma, backup*, *.bak, *.swp, tsconfig.json, and more.

frontend/nginx.conf

@@ -10,6 +10,28 @@ server {
     gzip_min_length 1024;
     gzip_types text/plain text/css text/xml text/javascript application/javascript application/json application/xml+rss image/svg+xml;
 
+    # Security headers
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    # Block access to sensitive files and directories
+    location ~ /\. {
+        deny all;
+        return 404;
+    }
+
+    location ~ \.(env|git|gitignore|dockerignore)$ {
+        deny all;
+        return 404;
+    }
+
+    location ~ ^/(node_modules|\.git|\.vscode|package\.json|package-lock\.json|vite\.config|tsconfig\.json)/? {
+        deny all;
+        return 404;
+    }
+
     # SPA fallback - serve index.html for all non-file routes
     location / {
         try_files $uri $uri/ /index.html;