refine nginx caching strategy and add service worker update prompt with periodic checks

frontend/nginx.conf

@@ -10,12 +10,45 @@ server {
     gzip_min_length 1024;
     gzip_types text/plain text/css text/xml text/javascript application/javascript application/xml+rss application/json;
 
-    # Cache static assets
-    location ~* \.(js|css|png|jpg|jpeg|gif|ico|svg|woff|woff2|ttf|eot)$ {
+    # Hashed build assets — safe to cache forever
+    location /assets/ {
         expires 1y;
         add_header Cache-Control "public, immutable";
     }
 
+    # Other static files (icons, fonts at root etc.) — short cache
+    location ~* \.(png|jpg|jpeg|gif|ico|woff|woff2|ttf|eot)$ {
+        expires 7d;
+        add_header Cache-Control "public, max-age=604800";
+    }
+
+    # Never cache entry points — must always revalidate so clients
+    # can detect new frontend versions and service worker updates
+    location = /index.html {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        expires 0;
+    }
+
+    location = /sw.js {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        expires 0;
+    }
+
+    location = /registerSW.js {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        expires 0;
+    }
+
+    location = /manifest.webmanifest {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        expires 0;
+    }
+
+    location = /manifest.json {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        expires 0;
+    }
+
     # Proxy API requests to backend
     location /api/ {
         proxy_pass http://backend:8080;