Page is sent with Cache-Control: no-cache (closes #141)

nginx sent index.html with no Cache-Control, so a browser could keep
it after a deploy and ask for hashed assets the new build no longer
has, and show an empty page. location / now adds Cache-Control:
no-cache, which covers its try_files fallback to /index.html, and
includes security-headers.conf again, since its own add_header drops
the server's. /assets/ and the locations passed to the backend are
unchanged.

script/frontend-viewport-test fails unless / and a path that falls
back to the page carry Cache-Control: no-cache and
Content-Security-Policy, which comes from the same file as the other
security headers.

Model: opus-5-5

TODO.md

@@ -21,6 +21,18 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-18: the image's nginx sends the page with `Cache-Control: no-cache`
+  ([#141](https://git.eeqj.de/sneak/netwatch/issues/141)), so a browser that
+  keeps a copy checks with the server that it is current before using it again.
+  The page went out with no `Cache-Control`, so a browser could keep it after a
+  deploy and ask for files under `/assets/` that the new build no longer has,
+  and show an empty page. A path with no file of its own falls back to the page
+  and gets the same header. `location /` now includes the security headers
+  again, as `/assets/` does, since its own `add_header` drops the server's.
+  `/assets/` keeps its immutable caching. `make frontend-viewport-test` fails
+  unless `/` and a path that falls back to the page carry
+  `Cache-Control: no-cache` and `Content-Security-Policy`, which comes from the
+  same file as the other security headers
 - 2026-10-18: a browser that cannot format the header's clocks still probes
   ([#149](https://git.eeqj.de/sneak/netwatch/issues/149)). The clocks name the
   local time zone through `Intl.DateTimeFormat`'s `shortGeneric` option, which