Fix stale browser cache after redeployment with proper nginx cache headers

index.html is served with Cache-Control: no-cache so the browser always
fetches the latest version with updated asset hashes. Hashed assets under
/assets/ are cached indefinitely since their filenames change on rebuild.

This prevents browsers from serving old cached JS bundles (including the
broken obfuscated build) after a new deployment.

frontend/nginx.conf

@@ -7,7 +7,19 @@ server {
     root /usr/share/nginx/html;
     index index.html;
 
-    # Serve static files
+    # index.html must never be cached so new asset hashes are picked up
+    location = /index.html {
+        add_header Cache-Control "no-cache";
+        try_files $uri /index.html;
+    }
+
+    # Hashed assets are immutable — cache indefinitely
+    location /assets/ {
+        expires 1y;
+        add_header Cache-Control "public, immutable";
+    }
+
+    # SPA fallback
     location / {
         try_files $uri $uri/ /index.html;
     }
@@ -15,10 +27,4 @@ server {
     # Enable gzip compression
     gzip on;
     gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
-
-    # Cache static assets
-    # location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff2)$ {
-    #     expires 1y;
-    #     add_header Cache-Control "public, immutable";
-    # }
 }