feat(app): add prerender, self-hosted fonts and privacy page

Fonts come from npm, not Google, so no third-party font requests.
Pages are prerendered at build time; browser-only code is guarded.
nginx serves per-route HTML, a real 404 and gzip.

nginx.conf

@@ -3,6 +3,11 @@ server {
   server_name _;
   root /usr/share/nginx/html;
 
+  gzip on;
+  gzip_vary on;
+  gzip_min_length 1024;
+  gzip_types text/css application/javascript application/json application/manifest+json image/svg+xml text/plain;
+
   # index.html: never cache
   location = /index.html {
     add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate";
@@ -41,6 +46,12 @@ server {
     try_files $uri =404;
   }
 
+  # Self-hosted fonts, content-hashed by the build
+  location ^~ /media/ {
+    add_header Cache-Control "public, max-age=31536000, immutable";
+    try_files $uri =404;
+  }
+
   # Assets (Bilder, JSON, Fonts, etc.): just revalidate
   location ^~ /assets/ {
     add_header Cache-Control "no-cache, max-age=0, must-revalidate";
@@ -49,13 +60,17 @@ server {
 
   # Also no cache for other html site
   location ~* \.html$ {
-    add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate";
-    add_header Pragma "no-cache";
-    add_header Expires "0";
+    add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate" always;
+    add_header Pragma "no-cache" always;
+    add_header Expires "0" always;
     try_files $uri =404;
   }
 
   location / {
-    try_files $uri $uri/ /index.html;
+    add_header Cache-Control "no-store, no-cache, must-revalidate, proxy-revalidate";
+    # Prerendered pages live at <route>/index.html. Unknown URLs get the CSR shell
+    # with status 404 (error_page without "=" keeps the status).
+    try_files $uri $uri/index.html =404;
+    error_page 404 /index.csr.html;
   }
 }