fix: restore default nginx MIME types so HTML/JS are not downloaded

A server-level types{} block replaced mime.types, so index/JS were served
as application/octet-stream; with nosniff the browser saved them as files.

Co-authored-by: Cursor <cursoragent@cursor.com>

nginx.conf

@@ -4,6 +4,11 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
+    # Keep default MIME map (html/js/css). Do NOT put a server-level `types {}`
+    # here — it replaces mime.types and forces downloads (octet-stream + nosniff).
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
     # Security headers (Stage 2B §24.3)
     add_header X-Content-Type-Options "nosniff" always;
     add_header X-Frame-Options "DENY" always;
@@ -15,13 +20,7 @@ server {
     gzip_vary on;
     gzip_min_length 1024;
     gzip_comp_level 6;
-    gzip_types text/plain text/css application/json application/javascript image/svg+xml;
-
-    # Explicit 3D model MIME types
-    types {
-        model/gltf-binary glb;
-        model/stl stl;
-    }
+    gzip_types text/plain text/css application/json application/javascript text/javascript image/svg+xml;
 
     location = /version.json {
         add_header Cache-Control "no-store, no-cache, must-revalidate";
@@ -38,7 +37,14 @@ server {
         add_header Cache-Control "public, immutable";
     }
 
+    # 3D models only — scoped types override (does not wipe html/js MIME)
     location /models/ {
+        types {
+            model/gltf-binary glb;
+            model/stl stl;
+            application/octet-stream bin;
+        }
+        default_type application/octet-stream;
         expires 1y;
         add_header Cache-Control "public, immutable";
     }