Serve Hesychia crawler files as static text (#44)

## Summary
- `chat_web_app` nginx now has exact locations for `/robots.txt`, `/sitemap.xml`, and `/llms.txt`.
- Each location serves the static file or returns 404. It does not fall through to `index.html`.
- Other static apps are unchanged. The flag is `exact_root_files` on `chat_web_app` only.
- Merged current `master`, so the Stripe webhook proxy stays in place next to the new locations.
- Closes #43.

The file contents ship in the chat_web_app public-site PR.

## Test plan
- [ ] Render the web-static nginx template and confirm only `chat_web_app` gets the three exact locations
- [ ] Webhook location `/api/finance/webhooks/` is still present
- [ ] After deploy, `curl -I https://hesychia.ai/robots.txt` is `text/plain`, and a missing file would be 404 rather than HTML

Reviewed-on: #44

inventory/group_vars/all.yml

@@ -123,6 +123,21 @@ app_catalog:
     # to chat_backend so POST is not answered 405 by the SPA index.html.
     api_backend: chat_backend
     api_proxy_prefix: /api/finance/webhooks/
+    # /robots.txt, /sitemap.xml, and /llms.txt must not fall through to index.html.
+    exact_root_files: true
+    # Homepage was missing these. Enforcing CSP stays loose so Tianji, the API,
+    # websockets, and inline styles keep working. Report-Only is the strict policy.
+    security_headers: true
+    # Unknown URLs are HTTP 404 with public/404.html, not 200 + the SPA shell.
+    # Slash routes are directory index.html files from scripts/stampCanonicals.js.
+    # These extensionless routes are the matching files (keep in sync with
+    # llm-fe/src/llm-fe/utils/canonicals.js paths that do not end in /).
+    error_page_404: /404.html
+    html_exact_paths:
+      - /legal/terms-of-service
+      - /billing/success
+      - /billing/cancel
+      - /document_storage
   chat_backend:
     type: django
     repo: "{{ git_base_url }}/ai_ml_operations/chat_backend.git"