[Pentest] Potential clickjacking attack

[pini-sh-panda]

📝 Description

Adds X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none' to all nginx responses to prevent clickjacking attacks.

---

🛠️ Changes Made

    # Clickjacking protection
    add_header X-Frame-Options "DENY" always;
    add_header Content-Security-Policy "frame-ancestors 'none';" always;

    # Strip upstream X-Frame-Options to avoid duplicate headers in browser response
    proxy_hide_header X-Frame-Options;

---

---

✅ Checklist

• I have given the PR a well-structured title describing the domain and the specific change that was made
• I tested the changes in the browser (locally or via preview build)
• I confirmed that existing tests pass
• I added or updated unit / integration tests (if needed)
• I checked that this change doesn’t introduce new console warnings or lint / formatting errors
• I updated the relevant Jira ticket with the appropriate details and status

---

🔗 References

• Related ticket / issue: https://ecliptos.atlassian.net/issues?filter=14104&selectedIssue=IG4-2936
• Figma / design spec:
• Documentation:

---

🚨 Potentially Breaking Changes

• Yes
• No

---

Includes DRC change

• Yes
• No

If yes -> requires bump NPM version

---

🔍 Additional Notes

---

📸 Screenshots / Demos

---