Harden the public demo: no metrics or docs, security headers

[MaciejZiel]

Hosting audit findings.

• New public mode (create_app(public=True) / PGQUEUE_ADMIN_PUBLIC=1, always on in the demo): /metrics, /docs, /redoc and /openapi.json are not served. Tests cover the flag, the env var and the demo app.
• nginx: 404 for the same paths as defence in depth; deploy/termux/nginx-headers.conf (CSP all 'self', nosniff, frame-ancestors none + X-Frame-Options DENY, Referrer-Policy, Permissions-Policy) included in every location, including static, favicon and the stream.
• Found while checking under the CSP in a real browser: the dashboard set bar widths with style attributes, which a policy without unsafe-inline blocks. Now set through the DOM. After the fix, no console errors and the event stream stays live (checked with playwright-cli against the demo workload behind the same headers).
• README: what visitors can supply (nothing), retention bounds, exact files to change on the server.