/previz: password protect, add PDF export of the crowd previz

- nginx basic auth on /previz/ (login file lives on the server, mounted
  from docker/auth/, see DEPLOY.md step 8); private, no-store so
  Cloudflare never caches it
- Print styles for previz pages: dark, A4 landscape, one section a page;
  videos print as poster frames with a link
- scripts/previz-pdf.mjs (npm run previz:pdf) prints the page to
  public/previz/crowd/crowd-previz.pdf via Edge/Chrome DevTools
- "PDF" download link on the page

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker/nginx.conf

@@ -23,6 +23,16 @@ server {
         add_header Cache-Control "public, max-age=604800";
     }
 
+    # Client previz pages: password protected (file lives on the server, see DEPLOY.md).
+    # ^~ beats the media regex above, so nothing in here gets a public cache header
+    # and Cloudflare never serves it to someone who hasn't logged in.
+    location ^~ /previz/ {
+        auth_basic "Two Tales VFX previz";
+        auth_basic_user_file /etc/nginx/auth/previz.htpasswd;
+        add_header Cache-Control "private, no-store";
+        try_files $uri $uri/ $uri.html =404;
+    }
+
     # Offline worker for /set must always be revalidated so updates roll out
     location = /set/sw.js {
         add_header Cache-Control "no-cache";