정합성·보안·인덱스 개선

- health/시작 로그 버전을 package.json 기준으로 동적화
- express-rate-limit으로 로그인·이메일 쓰기 요청 IP 기준 제한, trust proxy 설정
- nginx 보안 헤더(nosniff·X-Frame-Options·Referrer-Policy) 추가
- 공개 덱 목록용 복합 인덱스 추가
- 서버 페이지네이션은 후속 과제로 todo에 기록

Co-authored-by: Cursor <cursoragent@cursor.com>

nginx/default.conf

@@ -21,6 +21,11 @@ server {
         image/svg+xml
         application/manifest+json;
 
+    # 보안 헤더 (add_header가 없는 location에 상속됨)
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
     # 공유 링크 → 덱 로드 페이지
     location ~ ^/d/([A-Za-z0-9]+)$ {
         return 302 /cardList.html?d=$1;
@@ -40,22 +45,28 @@ server {
     # HTML — 배포 직후 반영
     location ~* \.html$ {
         add_header Cache-Control "no-cache, must-revalidate";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
         try_files $uri =404;
     }
 
     # 핵심 JS — 구 URL(?v= 없음)도 최신 파일 제공 (CDN immutable 회피)
     location = /script/deck-favorites.js {
         add_header Cache-Control "no-cache, must-revalidate";
+        add_header X-Content-Type-Options "nosniff" always;
         try_files $uri =404;
     }
 
     location = /script/api.js {
         add_header Cache-Control "no-cache, must-revalidate";
+        add_header X-Content-Type-Options "nosniff" always;
         try_files $uri =404;
     }
 
     location = /script/auth-form.js {
         add_header Cache-Control "no-cache, must-revalidate";
+        add_header X-Content-Type-Options "nosniff" always;
         try_files $uri =404;
     }
 
@@ -63,6 +74,7 @@ server {
     location ~* \.css$ {
         expires 1h;
         add_header Cache-Control "public, must-revalidate";
+        add_header X-Content-Type-Options "nosniff" always;
         try_files $uri =404;
     }
 
@@ -70,6 +82,7 @@ server {
     location ~* \.js$ {
         expires 1h;
         add_header Cache-Control "public, must-revalidate";
+        add_header X-Content-Type-Options "nosniff" always;
         try_files $uri =404;
     }
 
@@ -77,6 +90,7 @@ server {
     location ~* \.(png|jpg|jpeg|gif|webp|ico|svg|woff2?)$ {
         expires 30d;
         add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
         try_files $uri =404;
     }