Serve Hesychia pages with 404s and security headers (#45)

## Summary
- Unknown Hesychia URLs return 404 with `404.html` instead of 200 and the app shell.
- Extensionless routes (`/legal/terms-of-service`, billing return paths, `/document_storage`) are served as HTML.
- `chat_web_app` sends the security headers. The enforcing CSP stays loose enough for Tianji, the API, and the new analytics hosts. A stricter policy is report-only.
- Production only: one-character paths redirect for HeyCatch short links.

Depends on #44. Merge that first, then retarget this to `master` if Gitea does not do it automatically.

## Test plan
- [ ] After #44 and this change are deployed, `curl -sI https://hesychia.ai/not-a-page` is 404.
- [ ] `curl -sI https://hesychia.ai/pricing/` is 200 once the frontend shells are published.
- [ ] Response headers include `Content-Security-Policy`, `X-Content-Type-Options: nosniff`, `X-Frame-Options: DENY`, and `Referrer-Policy`.
- [ ] `curl -sI https://hesychia.ai/x` is a 302 to `/?utm_source=heycatch&utm_campaign=x`.

Reviewed-on: #45

inventory/group_vars/all.yml

@@ -125,6 +125,19 @@ app_catalog:
     api_proxy_prefix: /api/finance/webhooks/
     # /robots.txt, /sitemap.xml, and /llms.txt must not fall through to index.html.
     exact_root_files: true
+    # Homepage was missing these. Enforcing CSP stays loose so Tianji, the API,
+    # websockets, and inline styles keep working. Report-Only is the strict policy.
+    security_headers: true
+    # Unknown URLs are HTTP 404 with public/404.html, not 200 + the SPA shell.
+    # Slash routes are directory index.html files from scripts/stampCanonicals.js.
+    # These extensionless routes are the matching files (keep in sync with
+    # llm-fe/src/llm-fe/utils/canonicals.js paths that do not end in /).
+    error_page_404: /404.html
+    html_exact_paths:
+      - /legal/terms-of-service
+      - /billing/success
+      - /billing/cancel
+      - /document_storage
   chat_backend:
     type: django
     repo: "{{ git_base_url }}/ai_ml_operations/chat_backend.git"