Scaffold defaults

npm create shadow-app writes a Dusk app that already follows this page, so the first deploy starts from the safe side.

• src/entry-server.ts pins allowedHosts to the host of APP_URL in production, sends HSTS on https, and turns on a strict csp with a nonce per request in production only (the dev server injects inline scripts). With the Clerk add-on the policy starts as reportOnly, because Clerk loads scripts and frames from the frontend API host of your key: add that host to script-src, connect-src, img-src and frame-src, then remove reportOnly.
• .gitignore ignores .env, every .env.* variant (so .env.production is never committed), *.pem, *.key and the .dusk folder. .env.example and .env.public stay tracked: the first holds placeholders and a comment that real values go in .env.local, the second holds names that the browser may read.
• The Convex sample (convex/tasks.ts) bounds the title to 200 characters, and with Clerk it refuses a signed-out caller inside the function, because a Convex function is a public endpoint whatever the page does.
• A Dockerfile built from Deploy needs a .dockerignore that excludes .env*, .git and node_modules, and runs as the node user.