added security enhancements

frontend/nginx.conf

@@ -1,10 +1,17 @@
 server {
   listen 80;
   server_name _;
+  server_tokens off;
 
   root /usr/share/nginx/html;
   index index.html;
 
+  add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'; base-uri 'self'; form-action 'self'" always;
+  add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+  add_header X-Content-Type-Options "nosniff" always;
+  add_header X-Frame-Options "SAMEORIGIN" always;
+  add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
+
   location / {
     try_files $uri $uri/ /index.html;
   }

frontend/public/robots.txt

@@ -0,0 +1,33 @@
+# FlockPal robots.txt
+# Allows normal search indexing while reserving rights against AI training and AI answer ingestion.
+
+User-agent: *
+Content-Signal: search=yes,ai-input=no,ai-train=no
+Allow: /
+
+User-agent: Amazonbot
+Disallow: /
+
+User-agent: Applebot-Extended
+Disallow: /
+
+User-agent: Bytespider
+Disallow: /
+
+User-agent: CCBot
+Disallow: /
+
+User-agent: ClaudeBot
+Disallow: /
+
+User-agent: CloudflareBrowserRenderingCrawler
+Disallow: /
+
+User-agent: Google-Extended
+Disallow: /
+
+User-agent: GPTBot
+Disallow: /
+
+User-agent: meta-externalagent
+Disallow: /