fix: instant CMS uploads + heritage dark/light + ISR caching

Eliminates the need to run "docker compose build" after uploading
images via HQ Command. Heritage page now respects light/dark mode.

CACHE INVALIDATION
- New helper src/lib/revalidate.ts called from /api/assets and
  /api/public-upload after every upload, delete, folder create
- Pages switch from force-dynamic to ISR with revalidate=60
  (regenerated on demand whenever content changes, plus 60s safety)
- Nginx now sends "max-age=300, must-revalidate" instead of "expires 30d"
  on /cases/, /applications/, /news/, /parts/, /footage/, /operations-inbox/
  so browsers revalidate via If-Modified-Since (304s on unchanged files)
- Next.js Image Optimizer aligned with same TTL via minimumCacheTTL=300
  and adds /_next/image location block in Nginx for correct headers

HERITAGE DARK/LIGHT FIX (Bug #8)
- Replaces hardcoded #0A0A0C / #00F0FF / text-white with proper
  light + dark variants throughout markdown renderer (tables, lists,
  headings, blockquotes, paragraphs, images)
- Hero section, navigation pill, and CMS-driven sections now switch
  with the global theme toggle

SECURITY HARDENING
- Server actions bodySizeLimit reduced from 500MB to 50MB
  (large uploads still go through /api/assets which uses Nginx 500MB cap)

DEPLOY NOTES
- Run on VPS:
    git pull
    docker compose up -d --build app
    docker compose exec nginx nginx -s reload
- No DB schema changes in this commit. Existing 2FA users / data untouched.

src/app/api/assets/route.ts

@@ -30,6 +30,7 @@
 import { NextRequest, NextResponse } from "next/server";
 import fs from "fs";
 import path from "path";
+import { revalidateContent, type RevalidateScope } from "@/lib/revalidate";
 
 const SCOPE_ROOTS: Record<string, string> = {
   applications: path.join(process.cwd(), "public", "applications"),
@@ -193,6 +194,9 @@ export async function POST(request: NextRequest) {
 
     const rel = subPath ? `${subPath}/${safeName}` : safeName;
 
+    // 🔥 Invalida caché para que la imagen aparezca sin recompilar
+    revalidateContent({ scope: scope as RevalidateScope, slug });
+
     return NextResponse.json({
       success: true,
       file: {
@@ -229,6 +233,8 @@ export async function PUT(request: NextRequest) {
 
     fs.mkdirSync(targetPath, { recursive: true });
 
+    revalidateContent({ scope: scope as RevalidateScope, slug });
+
     return NextResponse.json({
       success: true,
       folder: { name: safe, path: parentPath ? `${parentPath}/${safe}` : safe }
@@ -256,6 +262,8 @@ export async function DELETE(request: NextRequest) {
 
     fs.unlinkSync(targetPath);
 
+    revalidateContent({ scope: scope as RevalidateScope, slug });
+
     return NextResponse.json({ success: true, deleted: filePath });
   } catch (error) {
     console.error("Asset DELETE error:", error);