Add gzip compression and caching for static assets

The admin UI is a traditional multi-page app that loads ~13 separate
vendor/app JS+CSS files on every full navigation; none were compressed and
Cache-Control was max-age=0 (Express's default), forcing a revalidation
round-trip for every asset on every page view. Add gzip (compression
middleware) and sane Cache-Control (7d for vendor libs under
/static-modules, 1h for the app's own /static JS/CSS, which isn't
cache-busted). Matches the equivalent fix in theta42/proxy.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

nodejs/routes/index.js

@@ -26,13 +26,17 @@ const frontEndModules = ['bootstrap', 'mustache', 'jquery', '@fortawesome',
 
 // Server front end modules
 // https://stackoverflow.com/a/55700773/3140931
+// Vendor libraries only change when package versions are bumped (a rebuild),
+// so they're safe to cache aggressively; ETag/Last-Modified (on by default)
+// still cover that rare case with a cheap 304 instead of a stale asset.
 frontEndModules.forEach(dep => {
-  router.use(`/static-modules/${dep}`, express.static(path.join(__dirname, `../node_modules/${dep}`)))
+  router.use(`/static-modules/${dep}`, express.static(path.join(__dirname, `../node_modules/${dep}`), {maxAge: '7d'}))
 });
 
 // Have express server static content( images, CSS, browser JS) from the public
-// local folder.
-router.use('/static', express.static(path.join(__dirname, '../public')))
+// local folder. Shorter maxAge than /static-modules since this is the app's
+// own JS/CSS, which changes on every deploy and isn't cache-busted/fingerprinted.
+router.use('/static', express.static(path.join(__dirname, '../public'), {maxAge: '1h'}))
 
 // Public health endpoint for container/orchestration healthchecks.
 // Mounted at / (no auth) in app.js, so this is intentionally unauthenticated.