pre-review hardening: technical qualifiers across all courses, git/Argo CD proper nouns, a11y (skip link, main, focus-visible, reduced-motion net, textContent legends), perf (intrinsic image dims, decoding async, lazy scenes + will-change lifecycle), nginx ^~ /assets/ priority, OG/canonical/build-revision, preflight gates

nginx/default.conf

@@ -18,14 +18,17 @@ server {
     include /etc/nginx/security-headers.conf;
 
     # ---- Caching -------------------------------------------------------------
-    # Scene images are content-hashed at build time → safe to cache hard.
-    location /assets/ {
+    # Everything under /assets/ is content-fingerprinted at build time -> cache hard.
+    # `^~` gives this prefix priority over the regex `.js` location below, so fingerprinted
+    # JavaScript gets the immutable policy rather than no-cache.
+    location ^~ /assets/ {
         include /etc/nginx/security-headers.conf;
         expires 1y;
         add_header Cache-Control "public, immutable" always;
     }
 
-    # Scripts are NOT fingerprinted yet — revalidate so a deploy actually propagates.
+    # Any JS OUTSIDE /assets/ (there is none today) revalidates; fingerprinted app JS is
+    # handled immutably by the ^~ /assets/ block above.
     location ~* \.js$ {
         include /etc/nginx/security-headers.conf;
         add_header Cache-Control "no-cache" always;