Lukas
5d9cef7760
- Added OWASP-recommended security headers to nginx server block - CSP allows same-origin scripts and inline styles (required for Fluent UI v9) - X-Frame-Options: DENY prevents clickjacking - X-Content-Type-Options: nosniff prevents MIME-sniffing - Referrer-Policy: no-referrer prevents URL leakage - Permissions-Policy: disables geolocation, microphone, camera APIs - HSTS commented out until HTTPS is fully configured - All headers use 'always' directive for error responses (4xx, 5xx) - Updated Architekture.md with security header documentation Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>