Complete static-site migration: _headers/_redirects for 18 frontends (#1470)

The frontends moved to the @dfinity/static-site (certified-assets) recipe
but kept their legacy .ic-assets.json5 configs, which certified-assets
ignores — so their security headers were silently dropped and SPA
fallback was gone. Replace them per the static-site skill:

- Delete the 18 dead .ic-assets.json5 files.
- Add frontend/public/_headers: each example's CSP ported verbatim, plus
  the skill's baseline hardening (X-Frame-Options, X-Content-Type-Options,
  Referrer-Policy) and caching (immutable assets, revalidated HTML).
- Add frontend/public/_redirects with the SPA fallback /*  /index.html 200.
- Examples that only had a security_policy preset or X-Frame-Options and
  no explicit CSP (ic-pos, basic_vetkd) get the hardening headers only —
  no invented CSP, since a default-src 'self' would break ledger/II calls.
- image-classification: its .ic-assets.json5 sat in frontend/assets/ (not
  the Vite publicDir), so it never reached dist even on the legacy recipe;
  new files go in a real frontend/public/ so its CSP is now effective.
- AGENTS.md: document the _headers/_redirects convention.

Verified locally (encrypted_notes + image-classification): headers land
and are certified, SPA deep-link reload returns the shell.

Part of #1458.

Author: marc0olo

AGENTS.md

@@ -203,6 +203,26 @@ icp-cli applies `environment_variables` as canister settings at deploy time. Rea
 - Motoko: `Runtime.envVar<system>("PUBLIC_CANISTER_ID:xrc")`
 - Rust: `ic_cdk::api::env_var_value("PUBLIC_CANISTER_ID:xrc")` — never `env!()` (compile-time) or `std::env::var()` (no OS environment in WASM)
 
+### Frontend headers and routing
+
+Frontends use the `@dfinity/static-site` recipe (the certified-assets canister). Configure it with two files at the **root of the build's publish dir** — put them in `frontend/public/` (Vite's `public/` is copied to `dist/`), never in a subfolder that only gets bundled:
+
+- `_headers` — security headers and caching, Netlify-style. Certified-assets ships **no default headers**, so declare them explicitly. Baseline (tighten the CSP per app; keep each example's own `connect-src`/`script-src`):
+  ```
+  /*
+    X-Frame-Options: DENY
+    X-Content-Type-Options: nosniff
+    Referrer-Policy: strict-origin-when-cross-origin
+    Content-Security-Policy: default-src 'self'; ...
+  /assets/*
+    Cache-Control: public, max-age=31536000, immutable
+  /*.html
+    Cache-Control: public, max-age=0, must-revalidate
+  ```
+- `_redirects` — SPA fallback so deep-link reloads don't 404: `/*  /index.html  200` (a `200` rewrite, not a redirect).
+
+Do **not** use `.ic-assets.json5` — that is the legacy asset-canister config; certified-assets ignores it (it gets served as a dead asset). No HSTS in the baseline: `_headers` apply in local dev too, and a canister-served `Strict-Transport-Security` would force HTTPS on `http://…localhost`. Consult the `static-site` skill before changing these (reserved-header list, `_headers` matches the asset key not the URL, etc.).
+
 ---
 
 ## Motoko conventions

hosting/oisy-signer-demo/frontend/public/.ic-assets.json5

@@ -0,0 +1,13 @@
+/*
+  X-Frame-Options: DENY
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  Content-Security-Policy: default-src 'self';script-src 'self';connect-src 'self' http://localhost:* https://icp0.io https://*.icp0.io https://icp-api.io;img-src 'self' data:;style-src * 'unsafe-inline';style-src-elem * 'unsafe-inline';font-src *;object-src 'none';base-uri 'self';frame-ancestors 'none';form-action 'self';upgrade-insecure-requests;
+
+# Fingerprinted build assets never change - cache them hard
+/assets/*
+  Cache-Control: public, max-age=31536000, immutable
+
+# HTML should revalidate so redeploys are picked up
+/*.html
+  Cache-Control: public, max-age=0, must-revalidate

hosting/oisy-signer-demo/frontend/public/_headers

@@ -0,0 +1 @@
+/*  /index.html  200

hosting/oisy-signer-demo/frontend/public/_redirects

@@ -0,0 +1,12 @@
+/*
+  X-Frame-Options: DENY
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+
+# Fingerprinted build assets never change - cache them hard
+/assets/*
+  Cache-Control: public, max-age=31536000, immutable
+
+# HTML should revalidate so redeploys are picked up
+/*.html
+  Cache-Control: public, max-age=0, must-revalidate

motoko/ic-pos/frontend/public/.ic-assets.json5

@@ -0,0 +1 @@
+/*  /index.html  200

motoko/ic-pos/frontend/public/_headers

@@ -0,0 +1,13 @@
+/*
+  X-Frame-Options: DENY
+  X-Content-Type-Options: nosniff
+  Referrer-Policy: strict-origin-when-cross-origin
+  Content-Security-Policy: default-src 'self';script-src 'self';connect-src 'self' http://localhost:* https://icp0.io https://*.icp0.io https://icp-api.io;img-src 'self';object-src 'none';base-uri 'self';frame-ancestors 'none';form-action 'self';upgrade-insecure-requests;
+
+# Fingerprinted build assets never change - cache them hard
+/assets/*
+  Cache-Control: public, max-age=31536000, immutable
+
+# HTML should revalidate so redeploys are picked up
+/*.html
+  Cache-Control: public, max-age=0, must-revalidate

motoko/ic-pos/frontend/public/_redirects

@@ -0,0 +1 @@
+/*  /index.html  200