nginx: serve public_key to curl cleanly, restore lost security headers

`curl https://jayrup.me/public_key` is the documented way to get this key
onto a VPS, so both the file and the config serving it need to be exact.

Key file: drop the trailing space, one trailing newline. A key with no
trailing newline makes `curl ... >> ~/.ssh/authorized_keys` glue itself onto
the previous line and silently break every later key in the file.

nginx:
- `/assets/public_key` ignored $final_suffix, so curl got 404 while browsers
  got 200. Route both through the suffix-aware try_files.
- add_header does not merge across levels: the asset, PDF and .txt locations
  each declared one, so they inherited none of the security headers. The
  asset location now repeats them; the PDF and .txt locations no longer
  declare any (default_type / mime.types + charset do the job), so they
  inherit again.
- `add_header Content-Type application/pdf` appended a second Content-Type
  instead of setting it. Use default_type.
- `expires 30d` plus an explicit Cache-Control emitted two Cache-Control
  headers. Use one explicit header.
- add `charset utf-8` so text/plain (what curl gets) is not served
  charset-less while the content contains non-ASCII.

deploy: ship nginx.conf alongside public/. It is bind-mounted into the
container, so it never travelled with the rsync'd tree — the live config was
from May and predated the hardening committed in 0ee667a. Test with
`nginx -t` before reloading and restore the previous config on failure.

0 files changed, 0 insertions, 0 deletions