Mirror the openvidu.io hardening: heading outline, template escaping, Dependabot

[juancarmore]

Companion to OpenVidu/openvidu.io#127: the part of that work that applies to this repo. Merge together.

• Heading outline. The seven server tutorials stepped from ## Understanding the code to H4 endpoint headings; they are H3 now, matching the Go tutorial and the openvidu.io copies. Heading text is unchanged, so anchors survive.
• Template hardening. MkDocs' theme environment does not autoescape: page.meta.robots in the head and the footer's previous/next titles now escape. The referrer policy is declared in its meta form, the only one GitHub Pages allows, and the frame buster's known limit (its <noscript> fallback re-opens the page inside a script-less sandboxed frame) is recorded next to the code.
• Newsletter form. The email input gains an accessible name; the Mailchimp validation hooks with no script behind them are gone, so native validation applies. The stylesheet only targets #mc-embedded-subscribe and #mce-EMAIL, both kept.
• Dependabot now watches the dev image's base tag. The Python pins live inline in the workflow pip install lines, which Dependabot cannot read, so the Dockerfile is the part it can keep current.

Checked and not needed here

• Material 9.7.7 was already pinned (e638928) and is live: the published site serves bundle.d7400e89.
• Workflow input handling: publish-web takes no workflow_dispatch inputs, and the lychee workflow already passes its exit code through env. Nothing to quote.
• No image is wider than the 1920 px cap, there is no header.html or tabs.html override, and this repo has no publish tool, so the ovweb fixes, the hash-locked install and the Python floor do not apply. Its build hook is a separate, smaller file that imports nothing from ovweb.

Verification: mkdocs build --strict passes with zero warnings, and tools/sync-check.py --openvidu-io ../openvidu.io reports 43 tutorial pairs in sync against the openvidu.io branch.

Still open, as in the other repo: this repository has no branch ruleset either.

🤖 Generated with Claude Code

Sobre el check validate en rojo

Es esperado y se resuelve solo. El job hace checkout de OpenVidu/openvidu.io sin ref:, es decir su rama por defecto, así que compara estos tutoriales contra main, donde el arreglo de encabezados todavía no está: de ahí las 28 líneas que reporta. Contra la rama del PR emparejado el check pasa (tools/sync-check.py --openvidu-io ../openvidu.io → 43 pares en sintonía).

Orden de integración: primero openvidu.io#127 en main, y después este PR (o re-lanzar su check), que pasará a verde sin tocar nada.