Add heatpump compressor cycle analysis web app

Static page that plots Home Assistant on/off history of the heatpump
compressor with pan/zoom, per-phase hover durations and statistics
(min/max/mean/median, total on-time, duty cycle) for the visible range.
English/German UI. Served by nginx in Docker with basic auth, CSP and
a healthcheck; Plotly is vendored locally.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

nginx/default.conf

@@ -0,0 +1,36 @@
+server {
+    listen 80;
+    server_name _;
+    root /usr/share/nginx/html;
+    index index.html;
+
+    server_tokens off;
+    charset utf-8;
+
+    gzip on;
+    gzip_comp_level 6;
+    gzip_types text/css text/csv application/javascript;
+
+    auth_basic "Heatpump";
+    auth_basic_user_file /etc/nginx/.htpasswd;
+
+    location / {
+        try_files $uri $uri/ =404;
+        include /etc/nginx/security-headers.conf;
+    }
+
+    # the CSV is mounted separately so it can be replaced without touching the app
+    location = /history.csv {
+        alias /data/history.csv;
+        default_type text/csv;
+        include /etc/nginx/security-headers.conf;
+    }
+
+    # unauthenticated liveness probe for the container healthcheck
+    location = /healthz {
+        auth_basic off;
+        access_log off;
+        default_type text/plain;
+        return 200 "ok\n";
+    }
+}

nginx/security-headers.conf

@@ -0,0 +1,7 @@
+# Included per location: a location's own add_header drops inherited ones.
+add_header X-Content-Type-Options "nosniff" always;
+add_header X-Frame-Options "DENY" always;
+add_header Referrer-Policy "no-referrer" always;
+# Plotly injects inline styles and exports PNGs via data:/blob: URLs
+add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; object-src 'none'; base-uri 'none'; frame-ancestors 'none'" always;
+add_header Cache-Control "no-cache" always;