PR #117 merged: fix(nginx): repeat security headers in static-asset location (completes #115)

Why

Follow-up to #115. nginx's add_header inheritance rule: if a location block declares any add_header, it discards all inherited ones. The static-asset location adds Cache-Control, so every js/css/png/svg/font response — including user-uploaded files under /storage, exactly where nosniff matters most — was served without the #115 security headers.

What

Repeat the three security headers inside the static-asset location, with a comment explaining the nginx semantics so the next location added doesn't reintroduce the bug. Test extended to assert the headers appear inside that block specifically.

Verification

Full pest suite green (273 passed), pint clean.

Note for release notes: like #109/#115, existing apps need to regenerate docker/nginx.conf to pick this up.