#531 Cache public pages, pin images and Rust, publish the offline copy from releases, hide nginx's version

[Anonymous]

Originally created by: athanclark

Closes [#473], closes [#510], closes [#521]. Refs [#514] (two images left).

#473: public pages can be cached.

• Which requests: signed-out GET/HEAD of the home page, Explore, /for, help pages, profiles, and a timeline's page and its events.
• The header they get: Cache-Control: public, s-maxage=60, stale-while-revalidate=300 and Vary: Cookie.
• What stays private, no-store: anything with a session cookie or an Authorization header, router-payload (RSC) requests and 5xx responses.
• Where: server/shared-cache.mjs decides, platform/proxy.js sets the header, and server/shared-response.cjs (prepended to the standalone server) keeps RSC requests private and appends Cookie to Next's Vary.
• CSP nonce: the header and the page carry the same nonce, so a cached page still runs.
• Docs: docs/administration.md gets a "Reverse proxy, page caching and page speed" section, with an nginx cache sample and how to measure Core Web Vitals.

#521: nginx's version is hidden. The NixOS module sets serverTokens = mkDefault false, and its VM test checks the Server header is just nginx. The documented nginx sample has server_tokens off.

#510: the hosted offline copy changes only on stable releases.

• pages.yml becomes a reusable workflow, called by a new pages job in release.yml, or run by hand with a release tag. It no longer runs on every push to main.
• docs/guest-editing.md explains the shared github.io origin and recommends the downloaded file plus SHA256SUMS.txt.

#514: pins.

• Rust is fixed at 1.99.0 in every Dockerfile and workflow.
• Base images are pinned by digest as well as tag, as of today.
• Dependabot updates Docker images and actions weekly.
• test/ci-workflows.test.mjs checks that every build uses the same fixed Rust and that no image floats on latest.
• Left out: postgres:16-bookworm (it would conflict with [#527]) and archlinux:latest (there's no dated tag to pin to). Both are noted on [#514].

After merging:

• Run "Offline editor on openchronology.github.io" once by hand with the current release tag.
• Add the nginx cache on timescale.info, following the new docs section.

🤖 Generated with Claude Code

https://claude.ai/code/session_011fFY8eruEi1xAkkMBni13B

[Anonymous]

Ticket changed by: athanclark

• status: open --> closed