[FEAT] Fix some bug and css issues.

partitions/nginx.conf

@@ -10,26 +10,38 @@ server {
     gzip_min_length 1024;
     gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json;
 
+    # Security headers.
+    # NOTE: nginx does not inherit `add_header` into a location that declares its
+    # own add_header, so the asset/worker locations below repeat them.
+    add_header X-Frame-Options "SAMEORIGIN" always;
+    add_header X-Content-Type-Options "nosniff" always;
+    add_header X-XSS-Protection "1; mode=block" always;
+
     # PDF.js worker: serve the tracked .mjs with a JS MIME type
     location = /pdf.worker.min.mjs {
         default_type application/javascript;
         expires 1y;
         add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
     }
 
-    # Cache static assets
+    # Hashed assets are immutable (safe to cache for a long time)
     location ~* \.(js|mjs|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
         expires 1y;
         add_header Cache-Control "public, immutable";
+        add_header X-Content-Type-Options "nosniff" always;
     }
 
-    # All routes should serve index.html (SPA)
+    # SPA shell: never cache it, it references hashed chunks removed on deploy.
+    # `expires -1` emits `Cache-Control: no-cache` without using add_header, so
+    # the server-level security headers above are still inherited.
+    location = /index.html {
+        expires -1;
+    }
+
+    # All routes fall back to index.html (SPA)
     location / {
+        expires -1;
         try_files $uri $uri/ /index.html;
     }
-
-    # Security headers
-    add_header X-Frame-Options "SAMEORIGIN" always;
-    add_header X-Content-Type-Options "nosniff" always;
-    add_header X-XSS-Protection "1; mode=block" always;
 }