chore: add security.txt + robots.txt; document DMARC/AI Labyrinth remediation

caddy/WebCaddyfile.internal

@@ -87,6 +87,14 @@
         file_server
     }
 
+    # --- Serve /.well-known (security.txt, RFC 9116) without SPA fallback ---
+    handle /.well-known/* {
+        root * /usr/share/caddy
+        encode zstd gzip
+        header Cache-Control "public, max-age=86400"
+        file_server
+    }
+
     # --- Optional: force SEO view for humans via ?__seo=1 ---
     @force_seo expression `{query}.matches("(^|&)(__seo=1)($|&)")`
     handle @force_seo {

caddy/WebCaddyfile.local

@@ -73,6 +73,14 @@
 		file_server
 	}
 
+	# --- Serve /.well-known (security.txt, RFC 9116) without SPA fallback ---
+	handle /.well-known/* {
+		root * /usr/share/caddy
+		encode zstd gzip
+		header Cache-Control "public, max-age=86400"
+		file_server
+	}
+
 	# --- Serve SPA (simple) ---
 	handle @spa {
 		root * /usr/share/caddy

public/.well-known/security.txt

@@ -0,0 +1,4 @@
+Contact: mailto:gustavoocanto@gmail.com
+Expires: 2027-06-05T00:00:00.000Z
+Preferred-Languages: en
+Canonical: https://oullin.io/.well-known/security.txt

public/robots.txt

@@ -0,0 +1,3 @@
+User-agent: *
+Allow: /
+Disallow: /seo

tests/caddy/web-caddyfile.test.ts

@@ -45,4 +45,8 @@ describe('production web Caddy relay contract', () => {
 
 		expect(relayExclusions.length).toBeGreaterThanOrEqual(2);
 	});
+
+	it('serves /.well-known (security.txt) as static files without SPA fallback', () => {
+		expect(caddyfile).toMatch(/handle \/\.well-known\/\*\s*{[^}]*root \* \/usr\/share\/caddy[^}]*file_server[^}]*}/s);
+	});
 });