feat(cache): single-owner caching across nginx, edge and content edits

Rebuild production nginx from the repo (deployment/proxy/*) with a single
Cache-Control owner per route: the app stays the source, nginx only manages
headers, and Cloudflare stores the public API allowlist at the edge.

- deployment/proxy: nginx.conf, mime.types, nginx-cms.conf and the
  blue/green upstream snippet; config backed by scripts/nginx-sync.sh
  (idempotent install + reload, --check/--force).
- nginx serves Cache-Tag headers on the public allowlist (cms-public),
  gamedata, client and camera responses so the edge and purge stay in sync.
- src/lib/edge-cache.ts + tests: coalesced, fire-and-forget edge purges that
  no-op unless Cloudflare is configured; scripts/cf-purge.sh and
  cf-setup-cache.sh create and purge the cache rule.
- src/lib/cloudflare-api.ts: purgeCacheByTags/purgeCacheByUrls.
- Purge hooks after catalog exports (public + gamedata) and on shop, team,
  guild, photo and rare-values edits; ci-deploy purges after each release.
- src/proxy.ts excludes the imaging/images docs from the middleware matcher.

src/lib/services/catalog-git-queue.ts

@@ -73,6 +73,16 @@ export async function scheduleCatalogExport() {
 		after(async () => {
 			const { runCatalogExport } = await import("./catalog-git-export");
 			await runCatalogExport();
+			// Catalog + furnidata (gamedata) zijn net vers verwerkt: laat de
+			// Cloudflare edge-cache van die tags los. Fire-and-forget en
+			// no-op zonder token; s-maxage blijft de fallback.
+			const { EDGE_CACHE_TAGS, purgeEdgeCache } = await import(
+				"@/lib/edge-cache"
+			);
+			void purgeEdgeCache(
+				[EDGE_CACHE_TAGS.public, EDGE_CACHE_TAGS.gamedata],
+				"catalog-export",
+			);
 		});
 	} catch {
 		/* Standalone worker contexts use their scheduled retry. */