PR #115 merged: feat: harden generated nginx (server_tokens, security headers, scanner-path refusal)

House-rules hardening baked into the generator, so every app created from here on ships hardened by default rather than relying on anyone remembering a checklist:

• server_tokens off — stop advertising the nginx version.
• X-Content-Type-Options, X-Frame-Options SAMEORIGIN, Referrer-Policy strict-origin-when-cross-origin — all with always so they're on 4xx/5xx too.
• Commodity scanner probe paths (wp-login.php, xmlrpc.php, /wp-admin, app_dev.php, phpunit eval-stdin.php) refused at nginx before PHP boots — none can be legitimate on an app this package generates. Defense-in-depth behind the new Cloudflare edge rules, and the only defense for anything not behind Cloudflare.

Context: the estate took two big scanner sweeps this week (Jul 7/9, verified fully bounced) — this encodes what we want the default posture to be. Tests follow the existing position-assertion pattern (probe deny block must precede the php-fpm handler). 273 passing, larastan clean.

🤖 Generated with Claude Code