Block malicious path scanning in Nginx

[halfmoon01]

📌 Summary

Block sensitive path scanning (.git/config, .env, /geoserver) in Nginx that was returning 200 instead of 404.

---

🔗 Related Issue

Closes #26

---

🛠 Changes

• Add location ~ /\.git block → deny all, return 404
• Add location ~ /\.env block → deny all, return 404
• Add location /geoserver block → deny all, return 404
• All rules placed before SPA catch-all try_files

---

✅ Checklist

• Code compiles
• Tests added/updated
• No console errors
• Documentation updated
• CI passes