Render the header inside location / so it is not dropped by other location headers; remove the ineffective server-level directive.
Block script in user content when /i/ is opened as a document, e.g. SVG opened in a tab.
Multi-stage frontend embed, envsubst entrypoint for TLS vhosts and upload body limits, shared locations with minimal response headers and zero access logs.