fix(nginx): serve index.html with no-cache (H1)

[WolfTasks]

Small ops/frontend hardening from the 2026-07-07 backlog (H1), prepared as its own
spec+plan under docs/superpowers/.

Problem

frontend/nginx-spa.conf serves index.html with no Cache-Control. The
asset-cache regex deliberately doesn't match .html, so index.html is neither
immutable nor no-cache. A browser can therefore hold a stale index.html
(with old asset hashes) after a deploy until a manual hard-reload — exactly what
was seen after the v1.0.07 redeploy (2026-07-07).

Fix

Add a dedicated location = /index.html block setting Cache-Control: no-cache.
Because nginx add_header in a location replaces the server-level headers
(they aren't inherited when the child block has its own add_header), the block
re-declares all five security headers (X-Content-Type-Options, X-Frame-Options,
Referrer-Policy, Permissions-Policy, CSP) alongside the new Cache-Control.
Hashed assets keep public, immutable / 1-year. docker/nginx.conf (compose
proxy) needs no change.

Verification

No frontend test framework, so verified against the built config on nginx:alpine:

• nginx -t → syntax OK.
• curl -I / and /index.html → Cache-Control: no-cache and all five
  security headers (incl. CSP) present.
• curl -I /assets/index-<hash>.js → still public, immutable + 1-year Expires,
  no no-cache.

Spec/plan: docs/superpowers/specs/2026-07-10-h1-nginx-index-nocache-design.md
and matching plans/ (on local main).

🤖 Generated with Claude Code