feat(cache): single-owner caching across nginx, edge and content edits

Rebuild production nginx from the repo (deployment/proxy/*) with a single
Cache-Control owner per route: the app stays the source, nginx only manages
headers, and Cloudflare stores the public API allowlist at the edge.

- deployment/proxy: nginx.conf, mime.types, nginx-cms.conf and the
  blue/green upstream snippet; config backed by scripts/nginx-sync.sh
  (idempotent install + reload, --check/--force).
- nginx serves Cache-Tag headers on the public allowlist (cms-public),
  gamedata, client and camera responses so the edge and purge stay in sync.
- src/lib/edge-cache.ts + tests: coalesced, fire-and-forget edge purges that
  no-op unless Cloudflare is configured; scripts/cf-purge.sh and
  cf-setup-cache.sh create and purge the cache rule.
- src/lib/cloudflare-api.ts: purgeCacheByTags/purgeCacheByUrls.
- Purge hooks after catalog exports (public + gamedata) and on shop, team,
  guild, photo and rare-values edits; ci-deploy purges after each release.
- src/proxy.ts excludes the imaging/images docs from the middleware matcher.

src/actions/admin-rare-values.ts

@@ -4,6 +4,7 @@ import { eq } from "drizzle-orm";
 import { revalidatePath } from "next/cache";
 import { requirePermission } from "@/lib/admin/guard";
 import { db, WebsiteRareValueCategories, WebsiteRareValues } from "@/lib/db";
+import { EDGE_CACHE_TAGS, purgeEdgeCache } from "@/lib/edge-cache";
 import { formPositiveBigInt } from "@/lib/form-data";
 import { PERMS } from "@/lib/permissions";
 
@@ -34,6 +35,7 @@ export async function createCategory(formData: FormData): Promise<void> {
 		// Unique name collision or DB error — ignore, page will re-render unchanged.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function deleteCategory(formData: FormData): Promise<void> {
@@ -53,6 +55,7 @@ export async function deleteCategory(formData: FormData): Promise<void> {
 		// Not found or DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function createValue(formData: FormData): Promise<void> {
@@ -101,6 +104,7 @@ export async function createValue(formData: FormData): Promise<void> {
 		// DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function deleteValue(formData: FormData): Promise<void> {
@@ -114,6 +118,7 @@ export async function deleteValue(formData: FormData): Promise<void> {
 		// Not found or DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function updateCategory(formData: FormData): Promise<void> {
@@ -145,6 +150,7 @@ export async function updateCategory(formData: FormData): Promise<void> {
 		// Unique name collision or DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }
 
 export async function updateValue(formData: FormData): Promise<void> {
@@ -199,4 +205,5 @@ export async function updateValue(formData: FormData): Promise<void> {
 		// DB error — ignore.
 	}
 	revalidatePath("/admin/rare-values");
+	void purgeEdgeCache([EDGE_CACHE_TAGS.public], "rare values edited");
 }