docs(deploy): linesf/ short-circuit in nginx — prevent the 404-flood→auto-ban outage

When linesf/ (4.4GB fuzzy index) isn't deployed, the client probes many
linesf/{bucket}.json per fuzzy query — all 404. A log-mining auto-blocklist read
that burst as a 404-flood scanner and banned real visitors → full-site 403
outage (2026-06-13). Add 'location ^~ /data/linesf/ { access_log off; return 404; }'
to the deploy template (host-agnostic) and check in nginx.cohenjikan.conf (the
actual prod vhost adaptation, sans ngx_brotli) so a future redeploy can't
regress it. Client behaviour unchanged (load.ts still no-ops on 404; commit
9254250 now also latches after the first one).

Author: Cohenjikan

deploy/nginx.cohenjikan.conf

@@ -0,0 +1,58 @@
+# 诗云 / shiyun.cohenjikan.com — adapted for cohen #1 (no ngx_brotli module → gzip_static only).
+# Managed-by-hand companion to deploy/nginx.conf. Certbot will add the ssl_certificate lines.
+server {
+  server_name shiyun.cohenjikan.com;
+  root /var/www/shiyun/dist;
+  index index.html;
+
+  gzip_static on;     # serve precompressed file.gz when client accepts (precompress.mjs wrote them)
+  gzip on;            # else compress on the fly
+  gzip_vary on;
+  gzip_min_length 1024;
+  gzip_types application/json application/javascript text/css image/svg+xml text/plain;
+  charset utf-8;
+
+  add_header X-Content-Type-Options "nosniff";
+  server_tokens off;
+
+  # SPA: 诗云 is a hash-router (#a=… / #p=…), so every path just serves index.html.
+  location / {
+    try_files $uri $uri/ /index.html;
+  }
+  location = /index.html {
+    add_header Cache-Control "no-cache";
+  }
+  # content-hashed bundles → cache forever
+  location /assets/ {
+    add_header Cache-Control "public, max-age=31536000, immutable";
+  }
+
+  # ── Per-poet Range fetch (egress saver) ─────────────────────────────────────
+  # poems/{bucket}.json MUST be served RAW: byte offsets in poems/{bucket}.idx.json index the
+  # UNCOMPRESSED file, so `Range: bytes=off-end` must return exactly those bytes (status 206).
+  # Disable compression here (a compressed Range would slice the wrong bytes). Range on by default.
+  location /data/poems/ {
+    gzip_static off;
+    gzip off;
+    add_header Accept-Ranges bytes;
+    add_header Cache-Control "public, max-age=86400";
+  }
+  # ── linesf/ short-circuit (operational, NOT optional) ───────────────────────
+  # The 4.4GB fuzzy-search index (linesf/) is intentionally NOT deployed; the front-end fetches these
+  # shards and gracefully no-ops on 404 (load.ts loadFzShard). Return 404 cheaply WITHOUT touching disk
+  # AND keep these EXPECTED 404s out of the access log — otherwise every real searcher's burst of
+  # linesf 404s looks like a "404-flood scanner" to a log-mining auto-blocklist and gets the visitor
+  # banned (this caused a full-site 403 outage on 2026-06-13). Front-end behaviour is unchanged.
+  location ^~ /data/linesf/ {
+    access_log off;
+    return 404;
+  }
+  # lines/ + small jsons are fetched whole → compress them normally (big win on lines/).
+  location /data/ {
+    gzip_static on;
+    add_header Cache-Control "public, max-age=86400";
+  }
+
+  listen 80;
+  listen [::]:80;
+}

deploy/nginx.conf

@@ -59,6 +59,18 @@ server {
     add_header Accept-Ranges bytes;
     add_header Cache-Control "public, max-age=86400";
   }
+  # ── linesf/ short-circuit — keep EXPECTED 404s out of the access log (operational, not optional) ────
+  # linesf/ is the ~4.4 GB delete-1 fuzzy index. If you DON'T deploy it (common — it's a search fallback
+  # and load.ts no-ops on 404), the client still probes many linesf/{bucket}.json per fuzzy query, all
+  # 404. Two reasons to short-circuit them here: (1) a log-mining auto-blocklist will read that burst of
+  # 404s as a "404-flood scanner" and ban the REAL visitor — this caused a full-site 403 outage on
+  # 2026-06-13; (2) they're needless disk stat()s + (behind a CDN) origin pulls. `return 404` keeps the
+  # client's graceful-degrade path identical; `access_log off` keeps them out of any security log-miner.
+  # If you DO deploy linesf/, delete this block so the shards are served normally.
+  location ^~ /data/linesf/ {
+    access_log off;
+    return 404;
+  }
   # lines/ + the small jsons are fetched whole → compress them normally (big win on lines/, ~791 MB raw).
   location /data/ {
     add_header Cache-Control "public, max-age=86400";