nginx: enforce piped CSP, drop dead freshrss CSP and rss vhost

Promote piped.krz.sh from Content-Security-Policy-Report-Only to enforcing.
Validated in a real browser first: homepage, VOD playback and seek on two
videos, channel page and a 39-result search were all clean, and every host
contacted was already allowed (self, pipedapi, pipedproxy, blob:). No fallback
to pipedproxy.kavin.rocks, so viewer IPs stay on the self-hosted proxy. The
check was proven meaningful before being trusted by injecting a disallowed
image and confirming a securitypolicyviolation with disposition "report".

Remove the FreshRSS CSP (include file plus the $csp_freshrss map). The header
never reached a browser: rss.krz.sh is routed tunnel-direct to the container
on :8099 and never transits nginx. Promoting it would also have regressed
behaviour rather than hardened it, since browsers enforce the intersection of
stacked policies and this one was stricter than FreshRSS's own exactly where
feed content lives (no blob: in img-src, no * in media-src/frame-src).
FreshRSS keeps its own, correctly RSS-aware, policy.

Delete conf.d/rss.conf entirely. It was unreachable: no onion targets :10045,
no other vhost uses the port, and rss.zerolabs.sh is redirected to rss.krz.sh
at the Cloudflare edge before the origin is reached.

0 files changed, 0 insertions, 0 deletions