Add Nav, About/Projects pages and nginx hardening

Harden nginx: add CSP, HSTS, Referrer-Policy and Permissions-Policy;
include image/svg+xml in gzip types; set X-Content-Type-Options on
static assets; change try_files to return =404.

Add Nav component and wire into BaseLayout; add About and Projects
pages with projects.json, an initial blog post, and small layout/padding
adjustments (removed redundant back links).

src/content/blog/hello-world.md

@@ -0,0 +1,35 @@
+---
+title: "Welcome to the Den"
+date: 2026-03-04
+description: "First proper post. Why I built this site, what it runs on, and what to expect."
+draft: true
+---
+
+So I finally got around to setting up a proper blog. Welcome.
+
+## Why This Exists
+
+I wanted a place to write that wasn't owned by a corporation. No Medium, no Substack, no algorithm deciding who sees what. Just markdown files on my own server, served by nginx from a Docker container I control.
+
+That's the whole point of the den — owning your own space on the internet.
+
+## What It Runs On
+
+This site is built with [Astro](https://astro.build), which spits out pure static HTML at build time. No JavaScript runtime, no hydration, no client-side framework. Just HTML and CSS.
+
+It's served by nginx inside a Docker container, deployed from my Gitea instance. The whole pipeline is mine.
+
+## What to Expect
+
+I'll write when I have something to say. Probably a mix of:
+
+- Self-hosting adventures and homelab stuff
+- Privacy thoughts and digital autonomy
+- Technical things I figured out the hard way
+- Whatever else is on my mind
+
+No schedule, no engagement metrics, no SEO optimization. Just writing.
+
+---
+
+*Thanks for reading. Welcome to the den.*