fix: serve service worker with no-cache headers via exact-match location

The sw.js and workbox-*.js files were being caught by the immutable
static asset regex (expires 1y), causing stale service workers and
potential 502 errors during re-registration. Use location = /sw.js
(exact match, highest Nginx priority) and a regex for workbox files
that appears before the asset cache block.

Also removes the dead duplicate location blocks at the bottom of
the config that were never reached due to regex priority.

Co-authored-by: Cursor <cursoragent@cursor.com>

docker-compose.yml

@@ -20,7 +20,7 @@ services:
       context: .
       dockerfile: Dockerfile
       args:
-        CACHEBUST: "14"
+        CACHEBUST: "15"
         VITE_USE_MOCK_DATA: "false"
         VITE_CONTENT_ORIGIN: ${FRONTEND_URL}
         VITE_INDEEHUB_API_URL: /api

nginx.conf

@@ -45,6 +45,21 @@ server {
         add_header Content-Type application/manifest+json;
     }
 
+    # ── Service Worker — must be exact-match to avoid the immutable
+    # caching regex below. Browsers require fresh SW scripts.
+    location = /sw.js {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        expires off;
+        access_log off;
+    }
+
+    location ~* ^/workbox-.*\.js$ {
+        add_header Cache-Control "no-cache, no-store, must-revalidate";
+        expires off;
+        access_log off;
+    }
+
+    # Static assets — long-lived immutable cache
     location ~* \.(?:js|css|woff2|woff|ttf|otf|eot|svg|png|jpg|jpeg|gif|ico)$ {
         expires 1y;
         add_header Cache-Control "public, immutable";
@@ -130,23 +145,6 @@ server {
         try_files $uri $uri/ /index.html;
     }
 
-    # Service Worker
-    location /sw.js {
-        add_header Cache-Control "no-cache";
-        proxy_cache_bypass $http_pragma;
-        proxy_cache_revalidate on;
-        expires off;
-        access_log off;
-    }
-
-    location /workbox-*.js {
-        add_header Cache-Control "no-cache";
-        proxy_cache_bypass $http_pragma;
-        proxy_cache_revalidate on;
-        expires off;
-        access_log off;
-    }
-
     # Health check endpoint
     location /health {
         access_log off;