harden(sda): add CSP/HSTS/nosniff/Referrer + clean Server banner via server.py; same files/port (non-breaking)

fix: re-home static Space as Docker (static hosting 404s org-wide); serve same files via python http.server on 7860