Toolvana: production-ready media tools platform (CodeIgniter 4)

- 134-tool registry with programmatic SEO (unique titles/H1/descriptions,
  JSON-LD graphs, sitemap index, canonical 301 enforcement via required filter)
- DB-backed job queue (SKIP LOCKED) with drivers: Ffmpeg, Images (GD),
  Pdf (qpdf/gs/poppler), Youtube (thumbnails), Qr (server-side PNG)
- Security: SSRF guard, MIME validation, rate limits, API-key auth,
  bcrypt admin login, security headers
- Admin panel: dashboard, tools/categories/guides CRUD, SEO audit,
  analytics, job inspector with retry, system health, feature flags
- Docker deployment (nginx + web/api FPM pools + scalable workers),
  PHPUnit suite (19 tests / 1139 assertions), PWA manifest + service worker

docker/nginx/default.conf

@@ -0,0 +1,41 @@
+# Toolvana — nginx reverse proxy + static asset server.
+
+server {
+    listen 80;
+    server_name _;
+    root /app/public;
+    index index.php;
+
+    # security headers (TLS terminates here in production; enable HSTS after cert)
+    add_header X-Content-Type-Options nosniff always;
+    add_header X-Frame-Options SAMEORIGIN always;
+    add_header Referrer-Policy strict-origin-when-cross-origin always;
+
+    gzip on;
+    gzip_comp_level 5;
+    gzip_types text/plain text/css application/javascript application/json application/xml image/svg+xml;
+    # brotli: enable with the ngx_brotli module where available
+    # brotli on; brotli_types text/plain text/css application/javascript application/json image/svg+xml;
+
+    # --- static assets: immutable caching ------------------------------------
+    location ~* \.(css|js|svg|png|jpg|webp|woff2?|ico)$ {
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+        try_files $uri =404;
+    }
+
+    location / {
+        try_files $uri $uri/ /index.php$is_args$args;
+    }
+
+    # --- PHP-FPM to the web/api upstreams --------------------------------------
+    location ~ \.php$ {
+        try_files $uri =404;
+        include fastcgi_params;
+        fastcgi_pass web:9000;
+        fastcgi_read_timeout 120s;
+        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
+    }
+}
+
+# HTTP/3 note: run behind Cloudflare or a QUIC-enabled edge for h3.