feat: add mod editing, revision merges and secure game storage

Add immutable revisions, PGVN editor, asset replacement, merge and rebase workflows, authenticated media delivery and reachability GC. Harden the script interpreter, pin unrpyc and remove tracked build metadata. Include current compatibility checks, Naninovel import and regression tests.

frontend/nginx.conf

@@ -11,6 +11,7 @@ server {
         proxy_pass http://backend:8000;
         proxy_http_version 1.1;
         proxy_set_header Host $host;
+        proxy_set_header X-PGames-Accel 1;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $http_x_forwarded_proto;
         proxy_request_buffering off;
@@ -18,10 +19,16 @@ server {
         proxy_send_timeout 3600s;
     }
 
-    # content-addressed blobs: /blobs/<sha256><ext> -> /data/blobs/ab/cd/<id>
-    location ~ "^/blobs/(([0-9a-f]{2})([0-9a-f]{2})[0-9a-f]{60}(\.[a-z0-9]{1,8})?)$" {
-        alias /data/blobs/$2/$3/$1;
-        add_header Cache-Control "public, max-age=31536000, immutable";
+    location /blobs/ {
+        proxy_pass http://backend:8000;
+        proxy_set_header X-PGames-Accel 1;
+    }
+
+    location /_protected_blobs/ {
+        internal;
+        alias /data/blobs/;
+        add_header Cache-Control "private, no-cache" always;
+        add_header X-Content-Type-Options nosniff always;
         types {
             image/webp webp;
             image/png png;