security: rustdesk出库+ignore；nginx静态location补齐安全头(修add_header继承丢失)；tasks.py原子写；backup.sh可选异地；拍板清单落盘

nginx-docker.conf

@@ -15,6 +15,10 @@ server {
         try_files $uri =404;
         expires 1y;
         add_header Cache-Control "public, max-age=31536000, immutable" always;
+        # nginx 的 add_header 按层级整体覆盖继承：自带 add_header 的 location 必须重复安全头
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
         types {
             image/avif avif;
             image/gif gif;
@@ -237,6 +241,9 @@ server {
     location ~* ^/assets/.*\.(js|css|png|jpg|jpeg|gif|webp|avif|ico|svg|woff|woff2|ttf|eot)$ {
         expires 1y;
         add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
         access_log off;
     }
 
@@ -244,12 +251,18 @@ server {
     location ~* \.(png|jpg|jpeg|gif|webp|ico|svg|woff|woff2|ttf|eot)$ {
         expires 7d;
         add_header Cache-Control "public";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
         access_log off;
     }
 
     # index.html 不缓存，保证发版后立即生效
     location = /index.html {
         add_header Cache-Control "no-cache, no-store, must-revalidate";
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header X-Frame-Options "SAMEORIGIN" always;
+        add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     }
 
     # SPA 路由回退（放在最后，避免拦截上面的 API 请求）