Add custom 404 page and Apache .htaccess

404.html reuses the site's hero/ledger patterns: a descending candle
series that breaks its stop line, and a list linking to each front-page
section. .htaccess wires ErrorDocument to it, plus compression, caching,
and security headers for Apache hosts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.htaccess

@@ -0,0 +1,69 @@
+# ForexSignalz — Apache config for the static site.
+# Only used on Apache hosts (cPanel, shared hosting, LAMP boxes).
+# Netlify / GitHub Pages / Cloudflare Pages ignore this file — they serve
+# 404.html automatically because of its filename.
+
+# ── Custom error page ─────────────────────────────────────────
+# Path is absolute from the document root. If you deploy the site into a
+# subdirectory (e.g. /signals/), change this to /signals/404.html.
+ErrorDocument 404 /404.html
+
+DirectoryIndex index.html
+
+# Don't list directory contents when there's no index file.
+Options -Indexes
+
+AddDefaultCharset UTF-8
+
+# ── Redirect www → apex and force HTTPS ───────────────────────
+# Uncomment once the domain has a valid certificate. Skip both rules if your
+# host already terminates TLS and redirects in front of Apache — otherwise you
+# can end up in a redirect loop.
+# <IfModule mod_rewrite.c>
+#   RewriteEngine On
+#   RewriteCond %{HTTPS} off
+#   RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
+#   RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
+#   RewriteRule ^ https://%1%{REQUEST_URI} [R=301,L]
+# </IfModule>
+
+# ── Compression ───────────────────────────────────────────────
+<IfModule mod_deflate.c>
+  AddOutputFilterByType DEFLATE text/html text/css text/plain
+  AddOutputFilterByType DEFLATE application/javascript text/javascript
+  AddOutputFilterByType DEFLATE image/svg+xml application/json
+</IfModule>
+
+# ── Caching ───────────────────────────────────────────────────
+# HTML stays fresh so edits go live immediately; assets are cached hard.
+# style.css is cached for a week — bump it to style.css?v=2 in the HTML if you
+# need a change to land for returning visitors sooner than that.
+<IfModule mod_expires.c>
+  ExpiresActive On
+  ExpiresDefault                      "access plus 1 week"
+  ExpiresByType text/html             "access plus 0 seconds"
+  ExpiresByType text/css              "access plus 1 week"
+  ExpiresByType image/svg+xml         "access plus 1 month"
+  ExpiresByType image/x-icon          "access plus 1 month"
+</IfModule>
+
+<IfModule mod_headers.c>
+  <FilesMatch "\.html$">
+    Header set Cache-Control "no-cache, must-revalidate"
+  </FilesMatch>
+
+  # ── Security headers ────────────────────────────────────────
+  Header set X-Content-Type-Options "nosniff"
+  Header set Referrer-Policy "strict-origin-when-cross-origin"
+  Header set X-Frame-Options "SAMEORIGIN"
+  Header set Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=()"
+</IfModule>
+
+# ── Hide dotfiles (.htaccess, .gitignore, .git/) from the web ─
+<IfModule mod_authz_core.c>
+  <FilesMatch "^\.">
+    Require all denied
+  </FilesMatch>
+</IfModule>
+
+RedirectMatch 404 /\.git