add CSP-clean static build, hardened nginx config, and container image

Dockerfile

@@ -0,0 +1,22 @@
+# syntax=docker/dockerfile:1
+# Static teaching site: bash assembles dist/ from the split source, then a pinned
+# nginx-unprivileged serves it. No Node build — build.sh is plain bash + coreutils.
+
+# ---- build stage ----------------------------------------------------------
+# Reusing the digest the site image already pins: it's a bookworm-slim base that is
+# verified and cached in the zot pull-through mirror, so this layer costs nothing
+# extra. Only bash/sed/find/install are used here — node itself is incidental.
+FROM node:22-bookworm-slim@sha256:d9f850096136edbc402debdd8729579a288aac64574ada0ff4db26b6ae58b0b2 AS build
+WORKDIR /app
+COPY . .
+RUN bash build.sh
+
+# ---- runtime stage --------------------------------------------------------
+# Same vetted digest as the site. Renovate keeps it current.
+FROM ghcr.io/nginx/nginx-unprivileged:1.28.0-alpine@sha256:c97ff0bf7cbae369953c6da1232ec14ad9f971d66360c5698db0856a4cd657a0
+
+COPY nginx/default.conf /etc/nginx/conf.d/default.conf
+COPY nginx/security-headers.conf /etc/nginx/security-headers.conf
+COPY --from=build /app/dist /usr/share/nginx/html
+
+EXPOSE 8080