feat: add nginx config for tarot static site

Serves only index.html and cards/*.json — all other paths return 403.

nginx/nginx/sites-available/tarot.conf

@@ -0,0 +1,21 @@
+# Tarot static site.
+server {
+  listen 443 ssl;
+  server_name tarot.nhcarrigan.com;
+  ssl_certificate /etc/letsencrypt/live/tarot.nhcarrigan.com/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/tarot.nhcarrigan.com/privkey.pem;
+
+  root /home/naomi/tarot;
+
+  location = / {
+    try_files /index.html =404;
+  }
+
+  location ~ \.json$ {
+    try_files $uri =404;
+  }
+
+  location / {
+    return 403;
+  }
+}