Page is sent with Cache-Control: no-cache (closes #141)

nginx sent index.html with no Cache-Control, so a browser could keep
it after a deploy and ask for hashed assets the new build no longer
has, and show an empty page. location / now adds Cache-Control:
no-cache, which covers its try_files fallback to /index.html, and
includes security-headers.conf again, since its own add_header drops
the server's. /assets/ and the locations passed to the backend are
unchanged.

script/frontend-viewport-test fails unless / and a path that falls
back to the page carry Cache-Control: no-cache and
Content-Security-Policy, which comes from the same file as the other
security headers.

Model: opus-5-5

script/frontend-viewport-test

@@ -82,11 +82,17 @@ main() {
     # its location drops the server's own unless the location includes
     # the security headers again; only Content-Security-Policy is
     # checked, as it comes from the same file as the rest. curl tries up
-    # to ten more times, a second apart, while nginx starts.
+    # to ten more times, a second apart, while nginx starts. It runs
+    # without -S, which would print an error for every failed attempt,
+    # even when a later one succeeds.
     for path in / /no-such-page; do
-        headers="$(docker exec "$SERVER" curl -sS -o /dev/null -D - \
+        if ! headers="$(docker exec "$SERVER" curl -s -o /dev/null -D - \
             --retry 10 --retry-connrefused --retry-delay 1 \
-            "http://127.0.0.1:8080$path" | tr -d '\r')"
+            "http://127.0.0.1:8080$path")"; then
+            echo "frontend-viewport-test: nginx did not answer $path" >&2
+            exit 1
+        fi
+        headers="$(printf '%s\n' "$headers" | tr -d '\r')"
         if ! printf '%s\n' "$headers" | grep -qix 'Cache-Control: no-cache' ||
             ! printf '%s\n' "$headers" | grep -qi '^Content-Security-Policy:'; then
             echo "frontend-viewport-test: $path needs" \