feat(cache): single-owner caching across nginx, edge and content edits

Rebuild production nginx from the repo (deployment/proxy/*) with a single
Cache-Control owner per route: the app stays the source, nginx only manages
headers, and Cloudflare stores the public API allowlist at the edge.

- deployment/proxy: nginx.conf, mime.types, nginx-cms.conf and the
  blue/green upstream snippet; config backed by scripts/nginx-sync.sh
  (idempotent install + reload, --check/--force).
- nginx serves Cache-Tag headers on the public allowlist (cms-public),
  gamedata, client and camera responses so the edge and purge stay in sync.
- src/lib/edge-cache.ts + tests: coalesced, fire-and-forget edge purges that
  no-op unless Cloudflare is configured; scripts/cf-purge.sh and
  cf-setup-cache.sh create and purge the cache rule.
- src/lib/cloudflare-api.ts: purgeCacheByTags/purgeCacheByUrls.
- Purge hooks after catalog exports (public + gamedata) and on shop, team,
  guild, photo and rare-values edits; ci-deploy purges after each release.
- src/proxy.ts excludes the imaging/images docs from the middleware matcher.

src/actions/admin-guilds.ts

@@ -13,6 +13,7 @@ import {
 	Items,
 	Rooms,
 } from "@/lib/db";
+import { EDGE_CACHE_TAGS, purgeEdgeCache } from "@/lib/edge-cache";
 import { PERMS } from "@/lib/permissions";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
@@ -89,6 +90,7 @@ export async function disbandGuild(formData: FormData): Promise<void> {
 		targetId: id,
 	});
 	revalidatePath("/admin/guilds");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "guild disbanded");
 }
 
 export async function updateGuild(formData: FormData): Promise<void> {
@@ -151,4 +153,5 @@ export async function updateGuild(formData: FormData): Promise<void> {
 
 	revalidatePath("/admin/guilds");
 	revalidatePath(`/admin/guilds/${id}`);
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "guild updated");
 }

src/actions/admin-photos.ts

@@ -5,6 +5,7 @@ import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
 import { tryRemoveLocalPhotoFile } from "@/lib/admin/photo-files";
 import { CameraWeb, db } from "@/lib/db";
+import { EDGE_CACHE_TAGS, purgeEdgeCache } from "@/lib/edge-cache";
 import { PERMS } from "@/lib/permissions";
 import { logStaffActivity } from "@/lib/services/staff-activity";
 
@@ -33,4 +34,5 @@ export async function deletePhoto(formData: FormData): Promise<void> {
 
 	revalidatePath("/admin/photos");
 	revalidatePath("/photos");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "photo deleted");
 }

src/actions/admin-rare-values.ts

@@ -4,6 +4,7 @@ import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
 import { db, WebsiteRareValueCategories, WebsiteRareValues } from "@/lib/db";
+import { EDGE_CACHE_TAGS, purgeEdgeCache } from "@/lib/edge-cache";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { PERMS } from "@/lib/permissions";
 
@@ -34,6 +35,7 @@ export async function createCategory(formData: FormData): Promise<void> {
 		// Unique name collision or DB error — ignore, page will re-render unchanged.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function deleteCategory(formData: FormData): Promise<void> {
@@ -53,6 +55,7 @@ export async function deleteCategory(formData: FormData): Promise<void> {
 		// Not found or DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function createValue(formData: FormData): Promise<void> {
@@ -101,6 +104,7 @@ export async function createValue(formData: FormData): Promise<void> {
 		// DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function deleteValue(formData: FormData): Promise<void> {
@@ -114,6 +118,7 @@ export async function deleteValue(formData: FormData): Promise<void> {
 		// Not found or DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function updateCategory(formData: FormData): Promise<void> {
@@ -145,6 +150,7 @@ export async function updateCategory(formData: FormData): Promise<void> {
 		// Unique name collision or DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function updateValue(formData: FormData): Promise<void> {
@@ -199,4 +205,5 @@ export async function updateValue(formData: FormData): Promise<void> {
 		// DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }

src/actions/admin-shop.ts

@@ -5,6 +5,7 @@ import { revalidatePath } from "next/cache";
 import { redirect } from "next/navigation";
 import { requirePermission } from "@/lib/admin/guard";
 import { db, WebsiteShopArticles } from "@/lib/db";
+import { EDGE_CACHE_TAGS, purgeEdgeCache } from "@/lib/edge-cache";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { PERMS } from "@/lib/permissions";
 import { logServerError } from "@/lib/server-log";
@@ -149,6 +150,7 @@ export async function updateShopArticle(formData: FormData): Promise<void> {
 	}
 
 	revalidatePath(`/admin/shop/${id}`);
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "shop article updated");
 	redirect("/admin/shop");
 }
 
@@ -175,5 +177,6 @@ export async function deleteShopArticle(formData: FormData): Promise<void> {
 		return;
 	}
 
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "shop article deleted");
 	redirect("/admin/shop");
 }

src/actions/admin-teams.ts

@@ -4,6 +4,7 @@ import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
 import { db, WebsiteTeams } from "@/lib/db";
+import { EDGE_CACHE_TAGS, purgeEdgeCache } from "@/lib/edge-cache";
 import { PERMS } from "@/lib/permissions";
 
 export async function createTeam(formData: FormData): Promise<void> {
@@ -38,6 +39,7 @@ export async function createTeam(formData: FormData): Promise<void> {
 	});
 
 	revalidatePath("/admin/teams");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "team edited");
 }
 
 export async function deleteTeam(formData: FormData): Promise<void> {
@@ -47,4 +49,5 @@ export async function deleteTeam(formData: FormData): Promise<void> {
 	await db.delete(WebsiteTeams).where(eq(WebsiteTeams.id, id));
 
 	revalidatePath("/admin/teams");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "team edited");
 }