fix(security): 서버 연동 및 미디어 보안 강화

.dockerignore

@@ -0,0 +1,8 @@
+.git
+node_modules
+dist
+.env
+.env.*
+!.env.example
+*.log
+security-reports

.github/workflows/ci-cd.yml

@@ -34,7 +34,10 @@ jobs:
       - name: Run unit tests
         run: npm test
 
-      - name: Build production bundle
+      - name: Build production bundle and check for client secrets
+        env:
+          VITE_GEMINI_API_KEY: RALLYTRACK_BUILD_SECRET_SENTINEL
+          GEMINI_API_KEY: RALLYTRACK_BUILD_SECRET_SENTINEL
         run: npm run build
 
   deploy:

nginx.conf

@@ -1,3 +1,10 @@
+# conf.d files are included in the http context. Only known passive media can render inline.
+map $upstream_http_content_type $media_disposition {
+    default attachment;
+    "~*^video/(mp4|quicktime|webm)(;|$)" inline;
+    "~*^image/(jpeg|png)(;|$)" inline;
+}
+
 server {
     listen 80;
     server_name _;
@@ -18,8 +25,16 @@ server {
     # 도메인(Cloudflare) 경유 시 이 경로 하나로 미디어까지 단일 origin에서 서빙된다.
     location /rallytrack-videos/ {
         proxy_pass http://minio:9000;
+        proxy_hide_header Content-Security-Policy;
+        proxy_hide_header Content-Disposition;
+        proxy_hide_header X-Content-Type-Options;
+        proxy_hide_header Cache-Control;
+        add_header Content-Security-Policy "sandbox; default-src 'none'; media-src 'self'; img-src 'self'; style-src 'unsafe-inline'" always;
+        add_header X-Content-Type-Options "nosniff" always;
+        add_header Content-Disposition $media_disposition always;
+        add_header Cache-Control "private, no-store" always;
         proxy_http_version 1.1;
-        proxy_set_header Host $host;
+        proxy_set_header Host $http_host;
         proxy_buffering off;           # 영상 스트리밍/Range 요청
         proxy_request_buffering off;   # AI 서버의 presigned PUT 업로드
         proxy_read_timeout 600s;