Security+Perf: CSP nonces, robots.txt cleanup, minify JS

- index.php: replace unsafe-inline CSP with per-request nonces on all 13 inline scripts/styles
- robots.txt: remove sensitive config filenames (db-config, email-config, recaptcha-config)
- main.min.js: actually minified with terser (37KB -> 16KB, -38% gzipped)

robots.txt

@@ -21,9 +21,6 @@ Disallow: /*.inc$
 Disallow: /*.sql$
 Disallow: /*.sh$
 Disallow: /*.bak$
-Disallow: /db-config.php
-Disallow: /.email-config.php
-Disallow: /.recaptcha-config.php
 
 # Block query string URLs to prevent duplicate content
 Disallow: /*?*