- base image -> nginxinc/nginx-unprivileged:1.28-alpine, digest-pinned
(BREAKING for the docker path: container port 80 -> 8080; compose
mapping/healthcheck updated in the same change, cap_add dropped)
- nginx add_header inheritance fix: shared snippets file re-included in
every location that sets Cache-Control -- previously ALL security
headers were dropped on real responses (verified live before/after)
- server_tokens off; set_real_ip_from restricted to 127.0.0.1
- expires directives removed (duplicated Cache-Control); gzip_types
text/html redundancy removed (nginx -t warn)
