remove Dockerfile and .dockerignore; add security.txt, _headers, and _redirects for deployment

.dockerignore

@@ -1,19 +0,0 @@
-node_modules
-pnpm-lock.yaml
-.git
-.gitignore
-.env
-.DS_Store
-*.md
-LICENSE
-Makefile
-bin/
-manimations/
-llms/
-.husky
-.github
-.vscode
-themes/
-public/
-target/
-dist/

CLAUDE.md

@@ -17,7 +17,7 @@ A personal blog (andwati.com — "Thoughts and Musings") built with [Zola](https
 
 There is no JS/CSS build tooling beyond Zola itself: `compile_sass = true` in `zola.toml` means Sass under `sass/` is compiled directly by Zola.
 
-Docker: `Dockerfile` does a multi-stage build — `zola build` in the `ghcr.io/getzola/zola` image, then serves `public/` via `static-web-server`.
+Deployment is via Cloudflare (`wrangler.toml`, `npm run deploy` → `zola build && wrangler deploy`), serving `public/` as static assets on `andwati.com`/`www.andwati.com`.
 
 ## Content structure
 

Dockerfile

@@ -1,9 +0,0 @@
-FROM ghcr.io/getzola/zola:v0.22.1 AS zola
-
-COPY . /project
-WORKDIR /project
-RUN ["zola", "build"]
-
-FROM ghcr.io/static-web-server/static-web-server:2
-WORKDIR /
-COPY --from=zola /project/public /public

static/.well-known/security.txt

@@ -0,0 +1,4 @@
+Contact: mailto:[email protected]
+Expires: 2027-07-16T00:00:00.000Z
+Preferred-Languages: en
+Canonical: https://andwati.com/.well-known/security.txt

static/_headers

@@ -0,0 +1,7 @@
+/*
+  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://utteranc.es; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://www.google-analytics.com; font-src 'self'; connect-src 'self' https://www.google-analytics.com; frame-src https://www.youtube-nocookie.com https://utteranc.es; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
+  X-Frame-Options: DENY
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  Permissions-Policy: camera=(), microphone=(), geolocation=(), interest-cohort=()
+  Strict-Transport-Security: max-age=63072000; includeSubDomains; preload

static/_redirects

@@ -0,0 +1 @@
+/security.txt /.well-known/security.txt 301