website: _headers restores X-Frame-Options and text/plain for /scripts/ on Cloudflare Pages (lost with the 2026-10-30 move)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

website/_headers

@@ -0,0 +1,8 @@
+# Cloudflare Pages header rules (R-1228 follow-up, 2026-11-07). These two headers were set by DooPlex's nginx copy
+# (retired 2026-11-07) and were missing on Cloudflare since the 2026-10-30 move: framing by another site, and the
+# installer shown as text in a browser so an operator can read it before running it.
+/*
+  X-Frame-Options: SAMEORIGIN
+
+/scripts/*
+  Content-Type: text/plain; charset=utf-8