feat: HTTP shared cache for public marketing pages

Pages got fast again. Public marketing routes are still rendered
per-request by Next.js (force-dynamic, until the ISR bug gets isolated),
but their HTML is now cached at the Nginx layer for 60s with a 5-minute
stale-while-revalidate window. Result: only the first hit on a URL
inside a 60s window pays the SSR cost; every other visitor in that
window gets a sub-10ms cached response. While a cached entry is
revalidating, peers keep getting the stale copy — no cold starts, no
thundering herds.

NEXT.JS MIDDLEWARE (src/proxy.ts)
- isCacheablePublicPath() identifies routes safe to share-cache:
  /, /<locale>, /<locale>/applications, /<locale>/news,
  /<locale>/heritage. Excludes /<locale>/parts (auth-gated B2B portal)
  and /hq-command/*, /api/*, /_next/*.
- hasAuthCookie() short-circuits caching when the request carries a
  flux_session (admin CMS) or flux_b2b_session (client portal) cookie.
  Authenticated users always get a fresh per-account render.
- When both checks pass, the response gets:
    Cache-Control: public, s-maxage=60, stale-while-revalidate=300

NGINX (nginx/nginx.conf)
- New shared zone:
    proxy_cache_path /var/cache/nginx/flux levels=1:2
                     keys_zone=flux_html:50m max_size=1g inactive=24h
                     use_temp_path=off;
- Access log gets a `cache=$upstream_cache_status` field so we can
  audit hit/miss ratios in the live logs.

NGINX (nginx/conf.d/flux.conf — location /)
- proxy_cache flux_html + proxy_cache_revalidate on
- proxy_cache_use_stale: serves stale on backend errors / timeout /
  during update, so 502s during a Next.js restart never reach users.
- proxy_cache_background_update + proxy_cache_lock: only one upstream
  request fires when a cached entry expires; others keep getting stale.
- proxy_cache_bypass / proxy_no_cache wired to flux_session +
  flux_b2b_session cookies — admin and B2B traffic skips the shared
  cache entirely.
- X-Cache-Status response header (HIT/MISS/EXPIRED/STALE/UPDATING/BYPASS)
  for live debugging — open dev tools, refresh, watch the value flip.

WHAT YOU'LL FEEL
- First visitor on /en within a 60s window: ~150-300ms (SSR + DB).
- Second through Nth visitors in the same window: <10ms.
- Editor publishes a change in HQ Command → revalidatePath() inside
  the existing actions invalidates the Next.js cache; the next
  marketing-page request rebuilds and primes Nginx fresh. The 60s
  TTL bounds how long stale content can linger if revalidation is
  ever skipped.

NO BREAKING CHANGES
- Auth flows untouched (cookies bypass cache).
- HQ Command + API endpoints untouched (separate Nginx locations).
- Static assets (cases/, applications/, /branding/, /_next/static)
  unaffected — they had their own cache headers already.
- Server-side cache invalidation via revalidatePath() still works.

DEPLOY (David)
  cd /opt/flux-srl
  git pull
  docker compose up -d --build app
  docker compose exec nginx nginx -t
  docker compose exec nginx nginx -s reload

nginx/conf.d/flux.conf

@@ -186,5 +186,28 @@ server {
         # Strip any leaked container port from upstream redirects, just in
         # case Next.js still builds Location headers with :3000.
         proxy_redirect ~^https?://[^/:]+:3000(/.*)$ https://$host$1;
+
+        # ── Shared HTML cache ───────────────────────────────────────────
+        # Caches GET responses that come back with a Cache-Control header
+        # from Next.js (the middleware sets s-maxage=60 on public marketing
+        # pages). Authenticated requests skip the cache entirely. While a
+        # cached entry is being refreshed, other visitors keep getting the
+        # stale copy — no thundering herd, no cold starts visible to users.
+        proxy_cache flux_html;
+        proxy_cache_revalidate on;
+        proxy_cache_min_uses 1;
+        proxy_cache_lock on;
+        proxy_cache_use_stale error timeout updating http_500 http_502 http_503 http_504;
+        proxy_cache_background_update on;
+        proxy_cache_methods GET HEAD;
+
+        # Bypass cache for authenticated sessions (admin CMS or B2B portal)
+        # so logged-in users always see fresh, per-account content.
+        proxy_cache_bypass $cookie_flux_session $cookie_flux_b2b_session $http_pragma;
+        proxy_no_cache    $cookie_flux_session $cookie_flux_b2b_session $http_pragma;
+
+        # Surface cache status in response headers for debugging.
+        # X-Cache-Status: HIT | MISS | EXPIRED | STALE | UPDATING | BYPASS
+        add_header X-Cache-Status $upstream_cache_status always;
     }
 }