deploy: fix nginx security headers dropped by add_header inheritance

Found while verifying the first real provision: none of the four
security headers reached the browser on any HTML page.

nginx's add_header inheritance is all-or-nothing — a location that sets
any add_header of its own discards every header inherited from the
server block. "/" resolves through try_files to `location = /index.html`,
which sets Cache-Control, so HSTS, X-Content-Type-Options,
X-Frame-Options and Referrer-Policy were silently dropped exactly where
they matter. /assets/ lost them the same way.

Move the four into snippets/security-headers.conf and include it in the
server block and in both locations that add a header of their own.

Also from the same provision run:
- ssl_stapling is dead config now that Let's Encrypt certificates carry
  no OCSP responder URL; it only logs a warning per cert on each reload;
- README step 3 chmod'ed /etc/exo to 750 but never set its group, so the
  exo user could not traverse it and exo-deploy died on "cannot read
  /etc/exo/<app>.env";
- README step 7 dropped http-extras.conf into conf.d without disabling
  the same directives in Debian's stock nginx.conf, and nginx refuses to
  start on a duplicate gzip / server_tokens.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/nginx/site.conf.template

@@ -46,20 +46,24 @@ server {
     root /srv/exo/{{APP}}/current/dist/client;
     index index.html;
 
-    add_header Strict-Transport-Security "max-age=31536000" always;
-    add_header X-Content-Type-Options    nosniff              always;
-    add_header X-Frame-Options           SAMEORIGIN           always;
-    add_header Referrer-Policy           strict-origin-when-cross-origin always;
+    include /etc/nginx/snippets/security-headers.conf;
 
     # Vite fingerprints everything under /assets — cache for a year.
     location ^~ /assets/ {
         access_log off;
+        # Re-included: this location's own add_header would drop the inherited ones.
+        include /etc/nginx/snippets/security-headers.conf;
         add_header Cache-Control "public, max-age=31536000, immutable" always;
         try_files $uri =404;
     }
 
     # The one file that must never be cached, or a deploy goes unseen.
-    location = /index.html { add_header Cache-Control "no-cache" always; }
+    # `/` lands here via try_files, so this is where the security headers
+    # actually have to be re-stated (see snippets/security-headers.conf).
+    location = /index.html {
+        include /etc/nginx/snippets/security-headers.conf;
+        add_header Cache-Control "no-cache" always;
+    }
 
     location = /robots.txt  { access_log off; }
     location = /sitemap.xml { access_log off; }