fix(web): 404 missing build assets instead of serving index.html

The SPA fallback caught /assets/ too, so a browser still running an
index.html from before a deploy asked for a chunk hash that no longer
existed and got 200 text/html back. The module import then failed on
HTML it tried to parse as JavaScript and the app rendered its error
page — with nothing in the server logs, because every response was a
200. Reproduced by requesting any nonexistent chunk.

Hashed assets now answer 404 when missing, which makes the stale-client
case visible rather than disguising it as a broken app, and index.html
is marked no-cache so the browser stops pointing at the previous
deploy's chunk hashes in the first place.

Verified with `nginx -t` against the pinned nginx:1.31-alpine image.

Claude-Session: https://claude.ai/code/session_01XvVRm84RrH9APR25g8pFXt

Author: dnplkndll

apps/web/nginx/nginx.conf

@@ -26,10 +26,31 @@ http {
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
     add_header X-XSS-Protection "1; mode=block" always;
 
+    # Hashed build assets are matched before the SPA fallback and answer 404
+    # when missing.
+    #
+    # Without this, `try_files ... /index.html` catches them too: a browser
+    # still running an index.html from before a deploy asks for a chunk hash
+    # that no longer exists and gets 200 text/html back. The module import then
+    # fails on HTML it tried to parse as JavaScript, and the app renders its
+    # error page — with nothing in the server logs, because every response was
+    # a 200. A 404 makes the stale-client case visible instead of disguising it
+    # as a broken app.
+    location /assets/ {
+      root   /usr/share/nginx/html;
+      try_files $uri =404;
+      # Content-hashed filenames, so they can be cached hard.
+      expires 1y;
+      add_header Cache-Control "public, immutable";
+    }
+
     location / {
       root   /usr/share/nginx/html;
       index  index.html index.htm;
       try_files $uri $uri/ /index.html;
+      # index.html itself must never be cached, or the browser keeps pointing
+      # at chunk hashes from the previous deploy.
+      add_header Cache-Control "no-cache, must-revalidate";
     }
   }
 }