perf(web): static images in public/ are served with max-age=0 #1062

Found in a live header audit of rate.vn (round 5). Unhashed static assets under public/ are served with Cache-Control: public, max-age=0, must-revalidate, and the Vercel edge reports X-Vercel-Cache: MISS:

• the navbar logo /img/rate-logo-64.png, shown on every page;
• the device photos /img/devices/*.jpg, which are product images on catalog, product and compare pages;
• /img/rate-og.png and /favicon.ico.

So every page view makes a conditional request for each of them, one extra round trip per image on a phone, while the hashed /_next/static/* files already get max-age=31536000, immutable.

Fix: a headers() rule in next.config.mjs for /img/:path* and the favicon. Browsers keep the files for a day and reuse a stale copy for a week while revalidating. The file names are not hashed, so the cache is not immutable.

Acceptance: those paths return the new Cache-Control in a production build. HTML, API and /_next/static headers are unchanged. E2E checks it.