Block dotfile access, remove custom CSS, fix cron npm install

- nginx: deny all requests to hidden files (/.git/config was publicly readable)
- nginx: remove CSS injection and /custom/ static file serving
- cron: install script deps at build time into /opt to avoid ro mount conflict
- docker-compose: widen cron build context for package.json COPY
- Delete unused theme/ghost-guild.css

cron/Dockerfile

@@ -11,8 +11,13 @@ RUN apk add --no-cache \
 
 WORKDIR /app
 
-COPY crontab /etc/crontabs/root
-COPY entrypoint.sh /entrypoint.sh
+# Install script dependencies at build time (into /opt so the ro volume mount doesn't shadow them)
+COPY scripts/package*.json /opt/scripts-deps/
+RUN cd /opt/scripts-deps && npm install --omit=dev
+ENV NODE_PATH=/opt/scripts-deps/node_modules
+
+COPY cron/crontab /etc/crontabs/root
+COPY cron/entrypoint.sh /entrypoint.sh
 RUN chmod +x /entrypoint.sh
 
 ENTRYPOINT ["/entrypoint.sh"]