nginx: immutable cache only for hashed assets; 7d for fixed-URL files; add avif

Also repeats the security headers inside each location, since a location-level add_header
drops the server-level ones.

deploy/nginx.conf

@@ -19,8 +19,24 @@ server {
 
   error_page 404 /404.html;
 
-  location ~* \.(?:css|js|jpg|jpeg|png|webp|svg|ico|woff2)$ {
+  # NOTE: an add_header inside a location drops ALL server-level add_headers, so each block below
+  # repeats the security headers.
+
+  # Content-hashed file names (Astro bundles, scripts/optimize-images.mjs output): a changed file
+  # gets a new URL, so these can be cached forever.
+  location ~* ^/(?:_astro|assets/opt)/ {
     try_files $uri =404;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Cache-Control "public, max-age=31536000, immutable";
   }
+
+  # Other static files keep a fixed URL when replaced (favicon, original JPEGs, logo), so cache
+  # them for a week, not forever.
+  location ~* \.(?:css|js|jpg|jpeg|png|webp|avif|svg|ico|woff2)$ {
+    try_files $uri =404;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
+    add_header Cache-Control "public, max-age=604800";
+  }
 }