refactor: serve static frontend with Go APIs

deploy/nginx.conf

@@ -0,0 +1,51 @@
+worker_processes auto;
+pid /tmp/nginx.pid;
+
+events {
+  worker_connections 1024;
+}
+
+http {
+  include /etc/nginx/mime.types;
+  default_type application/octet-stream;
+  access_log /dev/stdout;
+  error_log /dev/stderr warn;
+  sendfile on;
+  server_tokens off;
+
+  client_body_temp_path /tmp/client_temp;
+  proxy_temp_path /tmp/proxy_temp;
+  fastcgi_temp_path /tmp/fastcgi_temp;
+  uwsgi_temp_path /tmp/uwsgi_temp;
+  scgi_temp_path /tmp/scgi_temp;
+
+  server {
+    listen 3000;
+    root /usr/share/nginx/html;
+
+    location = /healthz {
+      access_log off;
+      default_type text/plain;
+      return 200 "ok\n";
+    }
+
+    # These paths are owned by the Go workload. Ingress routes them there;
+    # reject them here as defense in depth if Web is reached directly.
+    location ~ ^/(api|uploads|generated-results)(?:/|$) {
+      return 404;
+    }
+
+    location /_next/static/ {
+      expires 1y;
+      add_header Cache-Control "public, max-age=31536000, immutable";
+      try_files $uri =404;
+    }
+
+    location / {
+      add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+      add_header Pragma "no-cache" always;
+      add_header Expires "0" always;
+      try_files $uri $uri.html $uri/ /index.html;
+    }
+  }
+}