nginx: stamp must-revalidate on the HTML entrypoint

The Cache-Control on `location = /facere.html` wasn't reaching
browsers because requests for `/` matched `location = /` and never
fell into the named location even with try_files. Set the header
on both, with `always` so it applies to all response codes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

deploy/conf.d/default.conf

@@ -13,14 +13,15 @@ server {
     location ^~ /deploy/   { deny all; return 404; }
     location = /deploy-pull.sh { deny all; return 404; }
 
-    location = / {
-        try_files /facere.html =404;
-    }
-
     # The HTML entrypoint must NOT cache long — it carries the
     # ?v=… cache-busting tags that everything else relies on.
+    location = / {
+        add_header Cache-Control "public, max-age=0, must-revalidate" always;
+        expires off;
+        try_files /facere.html =404;
+    }
     location = /facere.html {
-        add_header Cache-Control "public, max-age=0, must-revalidate";
+        add_header Cache-Control "public, max-age=0, must-revalidate" always;
         expires off;
     }