content-hashed asset and cache busting

Vite renames every file under assets/ after a hash of its contents — index-a3f9c2.js — while index.html keeps its own name and points at the new hashes. Nothing is ever flushed or force-expired: a new build busts the cache by asking for a different filename. That splits dist/ into two halves with opposite needs. A hashed name always means the same bytes, so expires 1y with Cache-Control: public, immutable is safe. index.html needs no-cache, because it is the only file that says which hashes exist. One policy for the whole build lets the halves poison each other: a visitor holding a cached index.html keeps requesting the JavaScript that rsync --delete removed on the last deploy, and gets a blank page. Two curl -I calls, one per URL, are the only proof both location blocks really apply.