Initial build: Horizon 1 Prevention Suite + Horizon 2 Unlock demo

Svelte 5 + Vite PWA, styled to match moslem03.falahos.my's design system. Horizon 1: Faraid Calculator (shared calc core, 14 classical cases passing), Asset Registry, Wassiyah Generator (1/3 meter + heir-exclusion block), Hibah Tracker and Family Waqf Designator (shared marad al-mawt guardrail). Horizon 2: Digital Beneficial Claims — local non-custodial demo of the claim model and transfer restriction only. Two governance gates in this project's own PRDs were overridden per explicit product direction, and are flagged in-app and in README.md / deploy/DEPLOY.md rather than silently shipped as production-ready: - Family Waqf Designator ships ahead of scholarly sign-off (OPEN-01 in scholarly-review-log.md remains unresolved). - Horizon 2 ships ahead of the PRD's stated Phase 0 gate (legal opinion + signed institutional partner) with no confirmation that gate is cleared.
2026-08-13 16:55:58 +08:00
commit 6690696f7f
28 changed files with 7586 additions and 0 deletions
@@ -0,0 +1,80 @@
+# ──────────────────────────────────────────────
+# Nur Falah — Estate & Waqf Suite · Nginx SPA Config
+# Target: moslem04.falahos.my
+# ──────────────────────────────────────────────
+
+server {
+    listen 80;
+    listen [::]:80;
+    server_name moslem04.falahos.my;
+
+    root /usr/share/nginx/html;
+    index index.html;
+    error_page 404 =200 /index.html;
+
+    gzip on;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 5;
+    gzip_min_length 512;
+    gzip_types
+        text/html
+        text/plain
+        text/css
+        text/javascript
+        application/javascript
+        application/json
+        application/manifest+json
+        image/svg+xml
+        image/x-icon
+        font/woff2;
+
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "0" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+
+    location / {
+        try_files $uri $uri/ /index.html;
+        add_header Cache-Control "no-cache, must-revalidate" always;
+    }
+
+    location /assets/ {
+        expires 1y;
+        add_header Cache-Control "public, immutable, max-age=31536000" always;
+        access_log off;
+    }
+
+    location = /favicon.svg {
+        expires 7d;
+        add_header Cache-Control "public, max-age=604800" always;
+        access_log off;
+    }
+
+    location = /manifest.webmanifest {
+        expires 1d;
+        add_header Cache-Control "public, max-age=86400" always;
+        add_header Content-Type "application/manifest+json";
+    }
+
+    location /sw.js {
+        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+        add_header Service-Worker-Allowed "/";
+        expires off;
+        access_log off;
+    }
+
+    location ~* \.(js|css|woff2)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable, max-age=31536000" always;
+    }
+
+    location ~* \.(png|ico)$ {
+        expires 1y;
+        add_header Cache-Control "public, immutable, max-age=31536000" always;
+        access_log off;
+    }
+
+    location ~ /\. { deny all; access_log off; log_not_found off; }
+    location ~ ^/(node_modules|src)/ { deny all; access_log off; }
+}