security: harden static site (headers, exposed-file cleanup, privacy)

Proactive security & health pass. No live/exploitable vulnerabilities were
found; these changes remove information-disclosure surfaces and add
standard hardening.

- Remove publicly-downloadable 1.1 MB full source dump (code_export.txt)
  and stray empty l.php; add code_export.txt to .gitignore.
- Exclude dev files/folders (*.sh, *.py, docs/, templates/, tools/,
  README.md) from the rsync deploy so they never reach the live server.
- .htaccess: add X-Frame-Options, Referrer-Policy, Permissions-Policy,
  and a report-only Content-Security-Policy; add defense-in-depth deny
  block for dev/VCS files (robots.txt & sitemap.xml left served).
- .htaccess: fix root redirect to canonical msosorg.com + /en/.
- Swap 4 project-page YouTube embeds to youtube-nocookie.com so no
  Google cookies are set before consent (GDPR).
- Add rel="noopener" to 30 team social links on the About Us pages.
- Harden esc() in my-route.js to also escape single quotes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

en/projects/meet-student-slovenia-2024/index.html

@@ -295,7 +295,7 @@
                     <p>We know that not everyone managed to attend the NLB Gallery, but we therefore provided a high-quality livestream. The event was broadcast live and is now available for re-watching. If you want to feel the atmosphere and hear the honest stories from the panel, you can watch the entire event here 👇</p>
                     
                     <div class="video-responsive">
-                        <iframe src="https://www.youtube.com/embed/DJD02mQIE98" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
+                        <iframe src="https://www.youtube-nocookie.com/embed/DJD02mQIE98" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
                     </div>
 
                     <figure class="article-inline-image">

en/projects/paint-and-wine-at-sunset/index.html

@@ -240,7 +240,7 @@
                 <p>To capture the spirit of the night, we created an aftermovie, which you can watch below.</p>
 
                 <div class="video-responsive">
-                    <iframe src="https://www.youtube.com/embed/xGN3-6hnfE4" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
+                    <iframe src="https://www.youtube-nocookie.com/embed/xGN3-6hnfE4" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" allowfullscreen></iframe>
                 </div>
 
                 <figure class="article-inline-image">