Both server blocks were missing Content-Security-Policy and
Permissions-Policy entirely (dexarmarket.ru already had them). This is
defense-in-depth against XSS, not a fix for the underlying issue: the
customer session cookie is still non-HttpOnly and JS-readable, which
only a backend Set-Cookie change can close (BACKEND-API-REFERENCE.md
§12).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Drop the misleading trailing `=404` on try_files (index.html always exists
so it never triggered) and document, inline, the two ways a tenant's
frontend can reach its API (proxied /api vs absolute apiUrl) plus a note
that a 502/504 on refresh/back-navigation for an absolute-apiUrl tenant
(e.g. dexarmarket.ru -> api.dexarmarket.ru:445) is that backend's own
reverse proxy, not this file.
Adds a copy-paste server block template for onboarding a new marketplace
domain, and a Sprint 16 backend handoff doc covering the still-missing
draft/publish persistence endpoints, server-side validation expectations,
and the slug/route inconsistency in static-page data.
