Issue #253 opened: Harden nginx: deny PHP execution under writable paths

Adopt the estate-standard nginx hardening for the deployed app (coolify-mcp-docs): deny PHP execution under writable/upload paths (/storage, /uploads, /tmp), matching the rule already shipped to other apps in the estate (see StuMason/cgcambridge PR #1, commit 1e2999e, for the template).

Webshell campaigns actively probing the estate rely on dropping a PHP file into a writable directory and having nginx execute it — this rule closes that class of attack regardless of how a file gets written.

• Add location deny rules (or equivalent) for .php under writable paths
• Redeploy and verify with a dummy .php request returning 403/404

Source: cockpit estate security scan, 2026-07-09.