refactor: update nginx config for new structure

- Updated posterg.conf with new directory structure
- Document root: /var/www/posterg/public
- Explicitly deny access to: /src, /templates, /config, /storage, /tests, /scripts, /docs
- Added structure diagram in comments
- Updated deploy scripts security checks
- Replaced outdated posterg.conf.reference

All non-public directories outside webroot for security.
Defense-in-depth: explicit deny rules even though paths outside /public.

nginx/README.md

@@ -44,9 +44,13 @@ No additional SSL setup is needed on this server.
 ### File Access Protection
 - Database files (`.db`) - **BLOCKED**
 - Sensitive files (`.md`, `.sql`, `.env`) - **BLOCKED**
-- Shared directory - **BLOCKED**
-- Tests directory - **BLOCKED**
-- Cache directory - **BLOCKED**
+- `/src` directory (PHP source) - **BLOCKED**
+- `/templates` directory (PHP templates) - **BLOCKED**
+- `/config` directory (configuration) - **BLOCKED**
+- `/storage` directory (databases) - **BLOCKED**
+- `/tests` directory - **BLOCKED**
+- `/scripts` directory - **BLOCKED**
+- `/docs` directory - **BLOCKED**
 - Hidden files (`.git`, etc.) - **BLOCKED**
 
 ### Rate Limiting