PERF.16 Static delivery: no Brotli (gzip only), 7-day cache on files that are already cache-busted

Measured 2026-11-08: app files come back Content-Encoding: gzip only (cadcraft.js 198 KB to 61 KB); mod_brotli is loaded but not configured, and Brotli typically takes another 15 to 20 % off JS and CSS (1.4 to 1.7 MB of modules per app start). Every ?v= file carries Cache-Control: public, max-age=604800 (7 days); frozen release files and ?v=-busted shell files never change under their URL, so they can be immutable for a year (fewer revalidations on the second visit).

Plan (.htaccess + Apache conf, no code): Brotli for text/css, javascript, wasm, json, svg with gzip as the fallback (or pre-compressed .br/.gz next to release files written by bin/release-app.php, served with mod_rewrite, so compression happens once, not per request); Cache-Control immutable, max-age 1 year for /assets/apps/<slug>/<x.y>/ and ?v= URLs; keep 7 days for anything without a version in its URL. Measure with tools/perf/startup.mjs (bytes on the wire).