Serve security headers via static-web-server, drop Cloudflare deploy path

Production (Dokploy/Docker) was sending no security headers at all -
static/_headers and wrangler.toml were Cloudflare Pages/Workers
config that static-web-server never reads. Added sws.toml with the
same CSP/security headers and the two redirects from _redirects,
wired into the Dockerfile. Removed wrangler.toml, static/_headers,
static/_redirects, the wrangler devDependency/deploy script, and
related .gitignore/.dockerignore entries since Cloudflare deploy is
no longer used.

Also fixed a console error in theme.js where the Utterances
postMessage call could fire before the comments iframe navigated to
utteranc.es.

package.json

@@ -4,13 +4,11 @@
   "devDependencies": {
     "@resvg/resvg-js": "^2.6.2",
     "satori": "^0.29.0",
-    "wawoff2": "^2.0.1",
-    "wrangler": "^4"
+    "wawoff2": "^2.0.1"
   },
   "scripts": {
     "generate:llms": "node scripts/generate-llms.mjs",
     "generate:og": "node scripts/generate-og-images.mjs",
-    "build": "npm run generate:llms && npm run generate:og && zola build",
-    "deploy": "npm run build && wrangler deploy"
+    "build": "npm run generate:llms && npm run generate:og && zola build"
   }
 }