Fix nginx deduplication: remove nginx/scripts/ entirely, fix README typos and dead references

README.md

@@ -35,7 +35,6 @@ posterg/
 │   └── manage-admin-users.sh # Run on server with sudo to manage htpasswd
 └── nginx/           # nginx config and reference files
     ├── posterg.conf
-    ├── scripts/      # Server setup scripts (password, PHP SQLite)
     └── docs/         # Documentation
 ```
 
@@ -95,4 +94,4 @@ ssh posterg "sudo bash /tmp/manage-admin-users.sh"
 - Admin panel protected by nginx `auth_basic` + PHP session (`AdminAuth`)
 - Uploads stored outside webroot, served via controlled `media.php`
 - Rate limiting on public search (`src/RateLimit.php`)
-- See `docs/TODO.SECURITY.md` for outstanding items
+- See `nginx/docs/SECURITY_HEADERS.md` for security headers reference