feat(cinny-web): serve avatar decorations from chat.lotusguild.org/decorations (#22)

Decorations came through Nextcloud's public DAV: a new PHP session (four
cookies) per image and no cache headers, on every decorated avatar. The
set (629 decorations + thumbnails, 573 MB) is now a versioned Gitea
generic package (avatar-decorations 1.0.0, 4 tar parts), pinned by
sha256 in cinny/decorations.sha256. LXC 106's deploy installs it to
/var/www/decorations-<version> (verified against the pin and the
in-package manifest; previous version kept; failures leave the live set
alone), and nginx serves /decorations/ with a one-week public cache.
deploy/publish-decorations.sh publishes a new version and writes the pin.

Fixes #22

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

cinny/decorations.sha256

@@ -0,0 +1,4 @@
+a7aacaa65cb06e4b1c990b9253362f2eb148aae72e2e11c396d34e899792d68d  avatar-decorations-1.0.0.part1.tar
+a6919d8bb8e1c2f838b0f9acdbc1131cbfd7bfe5fe9c373b25f406474bd41095  avatar-decorations-1.0.0.part2.tar
+fb7624f2470659d933463187d2afe73428d5554291f62484c8a28fac6196f427  avatar-decorations-1.0.0.part3.tar
+909e07db0134b29258514acf4d598bb467aff8b157f0767b6c3afeadc1eb048c  avatar-decorations-1.0.0.part4.tar

cinny/nginx.conf

@@ -107,6 +107,17 @@ server {
         proxy_connect_timeout 5;
     }
 
+    # [matrix #22] Avatar decorations, installed by deploy/lxc106-cinny.sh from
+    # the Gitea generic package (outside the web root, so app deploys'
+    # rsync --delete never touches them). ^~ beats the image regex below: these
+    # can be replaced in place under the same name, so a week, not immutable.
+    location ^~ /decorations/ {
+        alias /var/www/decorations/;
+        include snippets/cinny-security-headers.conf;
+        add_header Cache-Control "public, max-age=604800" always;
+        location ~ /MANIFEST\.sha256$ { return 404; }
+    }
+
     location / {
         # add_header here drops the server-level headers, so include them again.
         include snippets/cinny-security-headers.conf;