Serve arquivos públicos só com tipos conhecidos

Em vez de depender do mime.types global, que entrega tipos +xml (.kml,
.xspf) inline, a location /media/ lista os tipos que podem abrir no
navegador e manda o resto como application/octet-stream.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker/config/nginx/sapl.conf

@@ -74,8 +74,38 @@ server {
         add_header X-Content-Type-Options nosniff always;
     }
 
+    # Só os tipos abaixo saem com Content-Type próprio; o resto (inclusive
+    # +xml que o mime.types global entregaria inline) vai como octet-stream.
     location /media/ {
         root /var/interlegis/sapl;
+        types {
+            application/pdf                                         pdf;
+            image/jpeg                                              jpg jpeg jpe;
+            image/png                                               png;
+            image/gif                                               gif;
+            image/webp                                              webp;
+            image/bmp                                               bmp;
+            image/tiff                                              tif tiff;
+            image/x-icon                                            ico;
+            text/plain                                              txt;
+            text/csv                                                csv;
+            audio/mpeg                                              mp3;
+            audio/ogg                                               ogg;
+            video/mp4                                               mp4;
+            video/webm                                              webm;
+            application/rtf                                         rtf;
+            application/zip                                         zip;
+            application/msword                                      doc;
+            application/vnd.ms-excel                                xls;
+            application/vnd.ms-powerpoint                           ppt;
+            application/vnd.openxmlformats-officedocument.wordprocessingml.document   docx;
+            application/vnd.openxmlformats-officedocument.spreadsheetml.sheet         xlsx;
+            application/vnd.openxmlformats-officedocument.presentationml.presentation pptx;
+            application/vnd.oasis.opendocument.text                 odt;
+            application/vnd.oasis.opendocument.spreadsheet          ods;
+            application/vnd.oasis.opendocument.presentation         odp;
+        }
+        default_type application/octet-stream;
         add_header X-Content-Type-Options nosniff always;
     }