Page is sent with Cache-Control: no-cache (closes #141)

nginx sent index.html with no Cache-Control, so a browser could keep
it after a deploy and ask for hashed assets the new build no longer
has, and show an empty page. location / now adds Cache-Control:
no-cache, which covers its try_files fallback to /index.html, and
includes security-headers.conf again, since its own add_header drops
the server's. /assets/ and the paths passed to the backend are
unchanged.

script/frontend-viewport-test fails unless / and a path that falls
back to the page carry Cache-Control: no-cache and
Content-Security-Policy, which comes from the same file as the other
security headers.

Model: opus-5-5

TODO.md

@@ -26,13 +26,13 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
   keeps a copy checks with the server that it is current before using it again.
   The page went out with no `Cache-Control`, so a browser could keep it after a
   deploy and ask for files under `/assets/` that the new build no longer has,
-  and show an empty page. A path with no file of its own falls back to the page
-  and gets the same header. `location /` now includes the security headers
-  again, as `/assets/` does, since its own `add_header` drops the server's.
-  `/assets/` keeps its immutable caching. `make frontend-viewport-test` fails
-  unless `/` and a path that falls back to the page carry
-  `Cache-Control: no-cache` and `Content-Security-Policy`, which comes from the
-  same file as the other security headers
+  and show an empty page. A path that `location /` answers with the page through
+  its `try_files` fallback gets the same header. `location /` now includes the
+  security headers again, as `/assets/` does, since its own `add_header` drops
+  the server's. `/assets/` keeps its immutable caching.
+  `make frontend-viewport-test` fails unless `/` and a path that falls back to
+  the page carry `Cache-Control: no-cache` and `Content-Security-Policy`, which
+  comes from the same file as the other security headers
 - 2026-10-18: a browser that cannot format the header's clocks still probes
   ([#149](https://git.eeqj.de/sneak/netwatch/issues/149)). The clocks name the
   local time zone through `Intl.DateTimeFormat`'s `shortGeneric` option, which

script/frontend-viewport-test

@@ -77,14 +77,15 @@ main() {
         -v "$ROOT/configs/security-headers.conf:/etc/nginx/security-headers.conf:ro" \
         "$SERVER_IMAGE" > /dev/null
 
-    # The page, and a path with no file of its own, which falls back to
-    # it, must go out with Cache-Control: no-cache. That add_header in
-    # its location drops the server's own unless the location includes
-    # the security headers again; only Content-Security-Policy is
-    # checked, as it comes from the same file as the rest. curl tries up
-    # to ten more times, a second apart, while nginx starts. It runs
-    # without -S, which would print an error for every failed attempt,
-    # even when a later one succeeds.
+    # The page, and /no-such-page, which location / answers with the
+    # page through its try_files fallback, must go out with
+    # Cache-Control: no-cache. That add_header in its location drops the
+    # server's own unless the location includes the security headers
+    # again; only Content-Security-Policy is checked, as it comes from
+    # the same file as the rest. curl tries up to ten more times, a
+    # second apart, while nginx starts. It runs without -S, which would
+    # print an error for every failed attempt, even when a later one
+    # succeeds.
     for path in / /no-such-page; do
         if ! headers="$(docker exec "$SERVER" curl -s -o /dev/null -D - \
             --retry 10 --retry-connrefused --retry-delay 1 \