fix(frontend): add a real robots.txt, cache hashed assets forever

Lighthouse audit findings:
- No robots.txt existed, so nginx's SPA fallback (try_files -> index.html)
  served the React app's HTML at /robots.txt -- crawlers got 44 "syntax
  not understood" lines instead of directives.
- No Cache-Control on /assets/*, so every visit re-fetched a hashed,
  content-addressed bundle that can never actually change under that
  URL. Lighthouse estimated 936 KiB/visit wasted on this alone.

Claude-Session: https://claude.ai/code/session_01F1M1Jic1wTSn4igUENynmZ

backend/deploy/nginx-visual.loki-code.dev.conf

@@ -16,6 +16,14 @@ server {
         proxy_cookie_path /auth /api/auth;
     }
 
+    # Fingerprinted build output (assets/<name>-<hash>.js/.css/...) -- the filename changes
+    # whenever the content does, so it's safe to cache "forever"; a stale copy is never served
+    # under the old URL after a deploy.
+    location /assets/ {
+        add_header Cache-Control "public, max-age=31536000, immutable" always;
+        try_files $uri =404;
+    }
+
     location / {
         try_files $uri /index.html;
     }

frontend/public/robots.txt

@@ -0,0 +1,2 @@
+User-agent: *
+Allow: /