Answer unknown paths of the tala.run sites with 404

Nginx sent every path that is not a file to index.html with 200, so
probes such as /wp-admin/install.php, xmlrpc.php and phpinfo.php were
answered as pages: scanners take that for a hit, and search engines
index soft 404s.

The three server blocks now fall back to @application, which serves
the app shell only for the routes of the application, / and
/docs/<page>, and answers every other path with 404. error_page keeps
index.html as the body of the 404, so a visitor still reaches the
landing page through the router.

A test reads the three sitemaps and requires every listed page to
match the accepted routes, and scanner paths, /docs and nested paths
not to; it also requires the same route rule in all three blocks.
OPERATIONS.md describes the expected 404s, and asks for
--no-same-owner, chown -R root:root and LF line endings when files are
copied from a developer machine: the 2026-10-18 release had left the
frontend owned by a Windows user ID.

Applied on the server with the owner's approval and verified: nginx -t
is clean; /, /docs/overview, talac /docs/command-line, tazel
/docs/commands, robots.txt and /api/v1/site answer 200;
/wp-admin/install.php, /no-such-page and /docs answer 404. npm test
passes, 45 tests.

0 files changed, 0 insertions, 0 deletions