Issue #1155: add robots.txt to both frontends; widen CloudFront invalidation

.github/workflows/lif_mdr_frontend.yml

@@ -61,5 +61,9 @@ jobs:
       run: |
         aws s3 sync --delete dist s3://${{ env.ENV_NAME }}-mdr-${{ env.AWS_ACCOUNT_ID }}-${{ env.AWS_REGION }}
         id=$(aws ssm get-parameter --name "/${{ env.ENV_NAME }}/mdr/DistributionId" --query "Parameter.Value" --output text)
-        aws cloudfront create-invalidation --distribution-id $id --paths "/"
+        # Invalidate "/*", not "/". `s3 sync --delete` replaces the whole
+        # object set, and stable-named files (index.html, robots.txt) keep
+        # serving from the edge cache otherwise. Hashed asset filenames
+        # cache-bust themselves; these do not.
+        aws cloudfront create-invalidation --distribution-id $id --paths "/*"
 

frontends/lif_advisor_app/public/robots.txt

@@ -0,0 +1,14 @@
+# LIF — dev/demo environments are not intended for public indexing.
+#
+# Disallow everything. These hosts serve non-production evaluation
+# environments; there is no content here that should appear in search
+# results, and indexing them invites crawler traffic we don't want.
+#
+# Deliberately does NOT enumerate paths. Listing specific routes here
+# would advertise them to the scanners this is meant to discourage.
+#
+# NOTE: robots.txt is advisory. Well-behaved crawlers honor it; scanners
+# and malicious bots ignore it entirely. It is not a security control.
+
+User-agent: *
+Disallow: /

frontends/mdr-frontend/public/robots.txt

@@ -0,0 +1,14 @@
+# LIF — dev/demo environments are not intended for public indexing.
+#
+# Disallow everything. These hosts serve non-production evaluation
+# environments; there is no content here that should appear in search
+# results, and indexing them invites crawler traffic we don't want.
+#
+# Deliberately does NOT enumerate paths. Listing specific routes here
+# would advertise them to the scanners this is meant to discourage.
+#
+# NOTE: robots.txt is advisory. Well-behaved crawlers honor it; scanners
+# and malicious bots ignore it entirely. It is not a security control.
+
+User-agent: *
+Disallow: /