M39: harden application and acceptance gates

frontend/nginx.conf

@@ -7,6 +7,13 @@ server {
   root /usr/share/nginx/html;
   index index.html;
 
+  server_tokens off;
+
+  gzip on;
+  gzip_vary on;
+  gzip_min_length 1024;
+  gzip_types text/css application/javascript application/json image/svg+xml font/woff2;
+
   add_header X-Content-Type-Options "nosniff" always;
   add_header X-Frame-Options "DENY" always;
   add_header Referrer-Policy "strict-origin-when-cross-origin" always;
@@ -44,8 +51,11 @@ server {
     try_files $uri /index.html;
   }
 
-  location ~* ^/assets/.+\.[a-fA-F0-9_-]+\.(css|js|woff2|png|svg)$ {
-    expires 1y;
+  # Vite emits content-hashed filenames like "Bookings-BXgkh2jX.js" (hyphen + 8 chars,
+  # base64url alphabet, one dot); anything under /assets/ matching that is immutable.
+  location ~* "^/assets/.+-[A-Za-z0-9_-]{8,}\.(css|js|woff2|png|svg)$" {
+    add_header Cache-Control "public, max-age=31536000, immutable" always;
+    add_header X-Content-Type-Options "nosniff" always;
     try_files $uri =404;
   }
 }