Page is sent with Cache-Control: no-cache (closes #141)

nginx sent index.html with no Cache-Control, so a browser could keep
it after a deploy and ask for hashed assets the new build no longer
has, and show an empty page. location / now adds Cache-Control:
no-cache, which covers its try_files fallback to /index.html, and
includes security-headers.conf again, since its own add_header drops
the server's. /assets/ and the locations passed to the backend are
unchanged.

script/frontend-viewport-test fails unless / and a path that falls
back to the page carry Cache-Control: no-cache and
Content-Security-Policy, which stands for the security headers.

Model: opus-5-5

script/frontend-viewport-test

@@ -7,6 +7,7 @@
 # headless Chrome at it over CDP, and asserts on computed layout at every
 # viewport width derived from the app's own CSS. See
 # test/viewport/README.md for what this covers and what it cannot.
+# Before that, it checks the headers the page is served with.
 #
 # Deliberately not part of script/check: it needs Docker and takes far
 # longer than the 20s budget make test has to stay inside.
@@ -75,6 +76,24 @@ main() {
         -v "$ROOT/configs/security-headers.conf:/etc/nginx/security-headers.conf:ro" \
         "$SERVER_IMAGE" > /dev/null
 
+    # The page, and a path with no file of its own, which falls back to
+    # it, must go out with Cache-Control: no-cache. That add_header in
+    # its location drops the server's own unless the location includes
+    # the security headers again; Content-Security-Policy stands for
+    # them. curl retries until nginx is listening.
+    for path in / /no-such-page; do
+        headers="$(docker exec "$SERVER" curl -sS -o /dev/null -D - \
+            --retry 10 --retry-connrefused --retry-delay 1 \
+            "http://127.0.0.1:8080$path" | tr -d '\r')"
+        if ! printf '%s\n' "$headers" | grep -qix 'Cache-Control: no-cache' ||
+            ! printf '%s\n' "$headers" | grep -qi '^Content-Security-Policy:'; then
+            echo "frontend-viewport-test: $path needs" \
+                "Cache-Control: no-cache and the security headers; got:" >&2
+            printf '%s\n' "$headers" >&2
+            exit 1
+        fi
+    done
+
     # The image's own entrypoint already exposes CDP on 9222 and passes
     # --no-sandbox, so only extra flags belong here; re-specifying the
     # debugging port collides with it and leaves the endpoint bound to