feat: add recommended Caddyfile and update usage guide for production configuration

setup/nginx-to-caddy/README.md

@@ -13,6 +13,8 @@ This module is intentionally conservative:
   - SSH into a host and collect `nginx -T`, `/etc/nginx` tarball, and a quick inventory summary.
 - `nginx_to_caddy.sh`
   - Convert basic Nginx server blocks into a generated Caddyfile.
+- `Caddyfile.recommended`
+  - Hardened baseline config (security headers, sensible body limits, streaming behavior).
 - `validate_caddy.sh`
   - Run `caddy fmt`, `caddy adapt`, and `caddy validate` on the generated Caddyfile.
 
@@ -24,6 +26,7 @@ cd setup/nginx-to-caddy
 ./extract_nginx_inventory.sh --host=<host> --user=<user> --port=22 --yes
 ./nginx_to_caddy.sh --input=./output/nginx-full.conf --output=./output/Caddyfile.generated --tls-mode=cloudflare --yes
 ./validate_caddy.sh --config=./output/Caddyfile.generated --docker
+./validate_caddy.sh --config=./Caddyfile.recommended --docker
 ```
 
 ## Conversion Scope