feat: HTTP shared cache for public marketing pages

Pages got fast again. Public marketing routes are still rendered
per-request by Next.js (force-dynamic, until the ISR bug gets isolated),
but their HTML is now cached at the Nginx layer for 60s with a 5-minute
stale-while-revalidate window. Result: only the first hit on a URL
inside a 60s window pays the SSR cost; every other visitor in that
window gets a sub-10ms cached response. While a cached entry is
revalidating, peers keep getting the stale copy — no cold starts, no
thundering herds.

NEXT.JS MIDDLEWARE (src/proxy.ts)
- isCacheablePublicPath() identifies routes safe to share-cache:
  /, /<locale>, /<locale>/applications, /<locale>/news,
  /<locale>/heritage. Excludes /<locale>/parts (auth-gated B2B portal)
  and /hq-command/*, /api/*, /_next/*.
- hasAuthCookie() short-circuits caching when the request carries a
  flux_session (admin CMS) or flux_b2b_session (client portal) cookie.
  Authenticated users always get a fresh per-account render.
- When both checks pass, the response gets:
    Cache-Control: public, s-maxage=60, stale-while-revalidate=300

NGINX (nginx/nginx.conf)
- New shared zone:
    proxy_cache_path /var/cache/nginx/flux levels=1:2
                     keys_zone=flux_html:50m max_size=1g inactive=24h
                     use_temp_path=off;
- Access log gets a `cache=$upstream_cache_status` field so we can
  audit hit/miss ratios in the live logs.

NGINX (nginx/conf.d/flux.conf — location /)
- proxy_cache flux_html + proxy_cache_revalidate on
- proxy_cache_use_stale: serves stale on backend errors / timeout /
  during update, so 502s during a Next.js restart never reach users.
- proxy_cache_background_update + proxy_cache_lock: only one upstream
  request fires when a cached entry expires; others keep getting stale.
- proxy_cache_bypass / proxy_no_cache wired to flux_session +
  flux_b2b_session cookies — admin and B2B traffic skips the shared
  cache entirely.
- X-Cache-Status response header (HIT/MISS/EXPIRED/STALE/UPDATING/BYPASS)
  for live debugging — open dev tools, refresh, watch the value flip.

WHAT YOU'LL FEEL
- First visitor on /en within a 60s window: ~150-300ms (SSR + DB).
- Second through Nth visitors in the same window: <10ms.
- Editor publishes a change in HQ Command → revalidatePath() inside
  the existing actions invalidates the Next.js cache; the next
  marketing-page request rebuilds and primes Nginx fresh. The 60s
  TTL bounds how long stale content can linger if revalidation is
  ever skipped.

NO BREAKING CHANGES
- Auth flows untouched (cookies bypass cache).
- HQ Command + API endpoints untouched (separate Nginx locations).
- Static assets (cases/, applications/, /branding/, /_next/static)
  unaffected — they had their own cache headers already.
- Server-side cache invalidation via revalidatePath() still works.

DEPLOY (David)
  cd /opt/flux-srl
  git pull
  docker compose up -d --build app
  docker compose exec nginx nginx -t
  docker compose exec nginx nginx -s reload

src/proxy.ts

@@ -68,9 +68,46 @@ export async function proxy(request: NextRequest) {
     }
   }
 
+  // ── Cache-Control on public pages ────────────────────────────────────
+  // Marketing pages (home, applications, news, heritage) are dynamic per
+  // request but the rendered HTML is the same for every visitor — no auth
+  // gating, no per-user data. So we let Nginx and the browser cache them
+  // briefly, falling back to a stale copy for up to 5 minutes while a
+  // refresh happens in the background. Result: first hit on a URL renders
+  // freshly (~150-300ms), every subsequent hit within 60s comes from cache
+  // (<10ms). Big perceived-speed boost without breaking ISR semantics.
+  if (isCacheablePublicPath(path) && !hasAuthCookie(request)) {
+    response.headers.set(
+      "Cache-Control",
+      "public, s-maxage=60, stale-while-revalidate=300"
+    );
+  }
+
   return response;
 }
 
+// Pages we're happy to cache at the edge: locale-prefixed marketing routes.
+// /parts is intentionally excluded — it's the auth-gated B2B portal and its
+// HTML changes per logged-in user.
+function isCacheablePublicPath(path: string): boolean {
+  if (path.startsWith("/hq-command")) return false;
+  if (path.startsWith("/api")) return false;
+  if (path.startsWith("/_next")) return false;
+  // Per-locale public pages
+  if (/^\/(en|it|vec|es|de)\/parts(\/|$)/.test(path)) return false;
+  if (/^\/(en|it|vec|es|de)(\/applications|\/news|\/heritage|\/?$)/.test(path)) return true;
+  // Root redirect to /en — also cacheable
+  if (path === "/") return true;
+  return false;
+}
+
+function hasAuthCookie(request: NextRequest): boolean {
+  return Boolean(
+    request.cookies.get("flux_session")?.value ||
+    request.cookies.get("flux_b2b_session")?.value
+  );
+}
+
 function sanitizeRedirectLocation(location: string, request: NextRequest): string {
   try {
     const forwardedHost =