Prevent stale web shell caching

GCP HTTP(S) LB adds Via header to forwarded requests, causing nginx to
treat them as proxied. Without gzip_proxied, nginx skips dynamic gzip
for these requests, resulting in uncompressed JS/CSS responses.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

flake.nix

@@ -54,15 +54,37 @@
                 include ${mimeTypes};
                 access_log /dev/stdout;
                 server {
+                  gzip on;
+                  gzip_proxied any;
+                  gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
                   listen 80;
                   index index.php index.html;
                   charset utf-8;
 
                   add_header X-Frame-Options "SAMEORIGIN";
                   add_header X-Content-Type-Options "nosniff";
+
+                  location /bundles/ {
+                    gzip_static on;
+                    root ${staticAssetsPath};
+                    try_files $uri =404;
+                    add_header Cache-Control "public, max-age=31536000, immutable";
+                  }
+
+                  location ~* \.(js|css|png|jpg|jpeg|gif|svg|ico|woff|woff2|ttf|eot)$ {
+                    gzip_static on;
+                    root ${staticAssetsPath};
+                    try_files $uri =404;
+                    add_header Cache-Control "public, max-age=31536000, immutable";
+                  }
+
                   location / {
-                  root ${staticAssetsPath};
-                    try_files $uri $uri/ /index.php?$query_string;
+                    gzip_static on;
+                    root ${staticAssetsPath};
+                    try_files $uri $uri/ /index.html;
+                    etag off;
+                    if_modified_since off;
+                    add_header Cache-Control "no-store" always;
                   }
                 }
               }