SSR prep: asset proxy behind flag, forwarded proto, header hygiene

Ticket 0054-FE section 5: (1) with the SSR flag on, /_frontend/assets/* is now proxied to the VPS release as well, deliberately without a file-exists guard so stale local SPA hashes cannot shadow the release; the proxy rules tag requests with env SSRPROXY and mod_headers adds X-Forwarded-Proto: https. (3) If-None-Match comparison in JsonCacheHeaders accepts the -gzip suffix that mod_deflate appends, so browser 304s work through compression. (4) X-TYPO3-Cache-Tags*/-Debug-Cache/-Cache-Lifetime/-Parsetime are stripped from responses (onsuccess and always tables - they leak record ids and overflowed the SSR node 16 KB header limit on news pages).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/vitec/Classes/Middleware/JsonCacheHeaders.php

@@ -42,7 +42,9 @@ final class JsonCacheHeaders implements MiddlewareInterface
 
         $etag = '"' . md5((string)$response->getBody()) . '"';
 
-        $ifNoneMatch = trim($request->getHeaderLine('If-None-Match'));
+        // mod_deflate suffixes the ETag it compressed ("<md5>-gzip");
+        // browsers send that form back, so accept it too (0054-FE 5.3).
+        $ifNoneMatch = str_replace('-gzip"', '"', trim($request->getHeaderLine('If-None-Match')));
         if ($ifNoneMatch !== '' && str_contains($ifNoneMatch, $etag)) {
             return (new Response())
                 ->withStatus(304)