nginx: HSTS, nosniff and a referrer policy on openvibe.media (its pages sent no security headers) (#139)

ddiff --git a/deploy/nginx/openvibe.media.conf b/deploy/nginx/openvibe.media.conf
iindex d30d411..778d08b 100644
---- a/deploy/nginx/openvibe.media.conf
++++ b/deploy/nginx/openvibe.media.conf
@@@ -18,6 +18,12 @@ server {
      proxy_read_timeout 3600s;
      proxy_send_timeout 3600s;
  
++    # The app sends no security headers on its pages (2026-10-17: none on openvibe.media). No CSP or frame rule:
++    # pictures, players and embeds here are loaded and framed by every OpenVibe site.
++    add_header Strict-Transport-Security "max-age=31536000" always;
++    add_header X-Content-Type-Options "nosniff" always;
++    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
++
      # Prometheus metrics are for loopback scrapers only (the app 404s proxied callers too).
      location ~* ^/metrics(/|$) { return 404; }