Block script in user content when /i/ is opened as a document, e.g. SVG opened in a tab.
Multi-stage frontend embed, envsubst entrypoint for TLS vhosts and upload body limits, shared locations with minimal response headers and zero access logs.
nobswebdev