docs: frame headers in the NPM Advanced template

X-Frame-Options DENY and CSP frame-ancestors 'none', inside location /
(it has its own add_header, so server-level headers aren't inherited).
Live on proxy host 58 since 2026-10-11.

Refs #12

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/npm-advanced.conf

@@ -9,7 +9,12 @@
 include /snippets/authelia-location.conf;
 
 location / {
+    # Headers go here, not at server level: a location with its own add_header
+    # (HSTS) doesn't inherit the server's.
     add_header Strict-Transport-Security $hsts_header always;
+    # No other site may frame the terminal (clickjacking).
+    add_header X-Frame-Options "DENY" always;
+    add_header Content-Security-Policy "frame-ancestors 'none'" always;
 
     auth_request /authelia;
     auth_request_set $user $upstream_http_remote_user;