/*
  # This is a security product; the headers are part of the claim.
  # Pages serves these on every response — no server config to drift.
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  X-Frame-Options: DENY
  Permissions-Policy: geolocation=(), microphone=(), camera=(), interest-cohort=()
  # Self-hosted fonts and no third-party anything, so the CSP can be strict.
  # 'unsafe-inline' for style only: Astro inlines the page's critical CSS.
  # No inline script and no inline style survive the build (the page script is
  # a real file in public/, and astro.config pins inlineStylesheets:'never'), so
  # this needs no 'unsafe-inline' anywhere. Verified against dist/, not assumed —
  # an inlined script under script-src 'self' fails SILENTLY: the page renders
  # and only the behaviour goes missing.
  Content-Security-Policy: default-src 'none'; img-src 'self' data:; style-src 'self'; font-src 'self'; script-src 'self'; connect-src 'self'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'

/.well-known/security.txt
  # RFC 9116 is explicit: "It MUST have a Content-Type of 'text/plain' with the
  # default charset parameter set to 'utf-8'." Pinned rather than left to
  # extension guessing, because a wrong type makes the file non-conforming while
  # still looking fine in a browser.
  Content-Type: text/plain; charset=utf-8

/_astro/*
  # Astro fingerprints these filenames, so they are safe to cache forever.
  Cache-Control: public, max-age=31536000, immutable
