website: _headers restores X-Frame-Options and text/plain for /scripts/ on Cloudflare Pages (lost with the 2026-10-30 move)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

website/CHANGELOG.md

@@ -1,4 +1,10 @@
-## 2026-10-30 — the site moves to Cloudflare Pages (D35 / R-1228); the contact form posts to api.felhom.eu
+## 2026-11-07 — two response headers back on Cloudflare (`website/_headers`)
+
+- DooPlex's retired nginx copy sent `X-Frame-Options: SAMEORIGIN` and served `/scripts/` as `text/plain`; Cloudflare
+  Pages did neither since 2026-10-30 (measured: no X-Frame-Options, the installer as `application/x-sh`;
+  `X-Content-Type-Options: nosniff` Cloudflare already sends). `website/_headers` restores both.
+
+## 2026-10-30 — the site moves to Cloudflare Pages (D35 / R-1228); the contact form posts to api.felhom.eu
 
 - **D35 (operator yes 2026-10-23; the switch approved 2026-10-30).** The site is uploaded to the Cloudflare Pages project
   `felhom-site` by `scripts/publish-site-cloudflare.sh` (website from `main`, `/scripts/` from the installer tag). After

website/_headers

@@ -0,0 +1,8 @@
+# Cloudflare Pages header rules (R-1228 follow-up, 2026-11-07). These two headers were set by DooPlex's nginx copy
+# (retired 2026-11-07) and were missing on Cloudflare since the 2026-10-30 move: framing by another site, and the
+# installer shown as text in a browser so an operator can read it before running it.
+/*
+  X-Frame-Options: SAMEORIGIN
+
+/scripts/*
+  Content-Type: text/plain; charset=utf-8