nginx: make cleberg.net self-contained on the onion

Serve images same-origin via a `location /img/ { alias /var/www/img/; }` block
on cleberg.net, so the .onion no longer pulls subresources from the clearnet.

Deliberately an nginx alias rather than a filesystem symlink. A symlink at
/var/www/cleberg.net/img worked but was destroyed by the very next deploy --
the site deploys with `rsync --delete`, which removes anything in the
destination that is not in the source tree, and that silently 404'd every image
on the site. Config-level aliasing cannot be removed by a deploy.

Tighten the cleberg.* CSP now that the site loads nothing cross-origin. The
weblorg source was changed to emit root-relative stylesheet and image URLs, and
the bubbles.town script was dropped, so parsing all deployed HTML returns zero
absolute subresources. Dropped img-src https://img.cleberg.net, style-src and
font-src https://cleberg.net, and script-src/connect-src https://bubbles.town;
the policy is now default-src 'self' with no host allowances.

upgrade-insecure-requests stays omitted: this vhost also serves the .onion over
plain http, where it would upgrade same-origin subresource URLs to https and
break them.

Set Referrer-Policy to same-origin, restoring the value Cloudflare's
security-headers toggle had been supplying. Removing that toggle silently
regressed it to strict-origin-when-cross-origin, which still sends the origin
to external sites; same-origin sends no referrer cross-origin at all.

Verified over a real Tor circuit: article pages carry 4 relative subresources
and 0 absolute, and images serve 200 from the onion.

0 files changed, 0 insertions, 0 deletions