fix(nginx): DRY security headers via nginx snippets (#6842)

[mrveiss]

Thinking Path

autobot-slm.conf.j2 had 5 add_header lines copy-pasted verbatim at the server level, /grafana/api/live/, and /grafana/ location blocks. Because nginx add_header in a child location block replaces all parent-level add_header directives, each block had to re-declare the full header set — causing PR #6751 to update CSP at three independent sites.

Fix: two nginx snippet files, one strict (server default) and one permissive (iframe-host for Grafana/Prometheus), deployed via Ansible before the main nginx site config.

What Changed

• templates/autobot-security-headers-strict.conf.j2: new — X-Frame-Options SAMEORIGIN, CSP with frame-ancestors 'none'
• templates/autobot-security-headers-iframe-host.conf.j2: new — CSP with frame-ancestors 'self', unsafe-eval/blob: for Grafana
• tasks/main.yml: 3 new tasks — ensure snippets dir exists, deploy strict snippet, deploy iframe-host snippet (all tagged slm,nginx, all notify test+reload)
• templates/autobot-slm.conf.j2: replace duplicate add_header blocks at server level, /grafana/api/live/, and /grafana/ with include directives; add strict include to colocated / location (which previously dropped server-level security headers via its own add_header)

Verification

After Ansible playbook run:

# Strict headers observable at default locations
curl -sI https://<slm-host>/ | grep -E "X-Frame|Content-Security|X-Content"
# iframe-host headers observable at Grafana
curl -sI https://<slm-host>/grafana/ | grep -E "Content-Security|frame-ancestors"
# frame-ancestors 'self' (not 'none') for Grafana
curl -sI https://<slm-host>/grafana/ | grep "frame-ancestors"

Risks

• /slm/index.html sub-location still has only Cache-Control + Pragma headers — security headers are dropped at that specific path. Pre-existing gap, filed as discovery below.
• CORS headers on /grafana/ remain as-is (optional, CORS_ENABLED guard).

Model Used

Claude Sonnet 4.6 (claude-sonnet-4-6)

Issue Link

Closes #6842

Checklist

• Code follows AutoBot patterns from CLAUDE.md
• Tests added or updated (nginx config — verified via nginx -t on deploy; no unit tests for Jinja2 templates)
• Documentation updated if behavior changed
• Pre-commit hooks pass (git commit runs them automatically)
• PR targets Dev_new_gui (not main)
• No secrets or credentials in the diff

[github-actions]

✅ SSOT Configuration Compliance: Passing

🎉 No hardcoded values detected that have SSOT config equivalents!