nginx: serve mgmt /static/ assets from disk (no Flask round-trip)

Generated management-domain server blocks now include a
location /static/ aliasing webui/static/ with Cache-Control: no-cache
(ETag revalidation -> 304), nosniff, and a restrictive CSP, so SPA
asset requests no longer reach Flask. Flask's static route remains
the dev-mode fallback.

- lib/nginx.py + daemon/handlers/nginx.py: static_root render context
  (the handler renders the template directly, so both paths need it)
- template: alias uses a trailing slash (nginx concatenates the
  location remainder onto the alias value)
- install.sh: a+rX on webui/static plus execute-up-the-parent-chain
  so the nginx worker (www-data) can traverse repo-in-$HOME installs
- tests: mgmt static location assertions (positive + non-mgmt negative)
- docs: AGENTS.md, architecture.md, security.md static-serving notes

scripts/install.sh

@@ -238,6 +238,15 @@ mkdir -p "${PROJECT_DIR}/config"/{dnsmasq,nginx,wireguard,firewall}
 mkdir -p "${PROJECT_DIR}/data"/{nginx/sites-enabled,dnsmasq,firewall,wireguard,acme}
 mkdir -p /etc/wireguard
 mkdir -p /etc/dnsmasq
+# nginx workers (www-data) serve webui/static directly from disk for the
+# management domain — ensure read access regardless of checkout umask.
+chmod -R a+rX "${PROJECT_DIR}/webui/static"
+# ...and traversal (x only) up the parent chain, so repo-in-$HOME installs work.
+_d="${PROJECT_DIR}"
+while [[ "$d" != "/" && -n "$d" ]]; do
+    chmod a+x "$d" 2>/dev/null || true
+    d="$(dirname "$d")"
+done
 # Set ownership: daemon owns project dir in prod, repo owner keeps ownership in dev.
 # The top-level .git (directory or worktree pointer file) is left untouched so
 # the repo owner's git isn't tripped by git's dubious-ownership check.