link: version the ladl.link cache and log rotation

Both were applied by hand during an incident and existed only in /etc on one
server. server-bootstrap.sh generates the ladl.link vhost, and its version had no
caching at all — so rebuilding the box would have silently restored a ~44 req/s
ceiling on a link being handed to a very large audience, with nothing in git
recording that the cache should exist. Laravel log rotation had the same problem:
none was configured anywhere, and logs had reached 808M across apps.

Now tracked under deploy/ and installed by bootstrap:

  nginx/conf.d/ladill-link-cache.conf        FastCGI cache zone
  nginx/snippets/ladill-link-cached.conf     cached path, 10m
  nginx/snippets/ladill-link-cached-short.conf   same, 60s
  nginx/snippets/ladill-link-public-cache.conf   which routes are cached
  nginx/snippets/ladill-link-hot-pages.conf  per-campaign slugs
  logrotate/ladill-laravel

Campaign slugs live in their own snippet so a hot link can be added or retired
with an nginx reload instead of a deploy, and bootstrap seeds that file only when
absent so it is never clobbered.

Caching stays deliberately narrow. ladl.link also serves the admin app, and the
cached path strips Set-Cookie, so anything reaching it would lose its session.
Only /q/, */bookshop-* and listed campaign pages are cached; SSO and dashboard
fall through untouched — verified after this change: both still set cookies and
carry no cache header.

Generated vhosts now include the snippet from the start, and an existing vhost is
patched in place (with a timestamped backup) rather than rewritten, since it may
carry local edits. Both paths are idempotent.

Applied to production as part of this change, so the committed config is the
config that is running rather than an untested transcription: page 12ms,
cover 14ms, vanity URL 11ms, all cache HIT.

Co-Authored-By: Claude <noreply@anthropic.com>

deploy/server-bootstrap.sh

@@ -73,6 +73,27 @@ else
   echo "WARN: run setup-service-subdomain-nginx.sh link manually"
 fi
 
+log "Installing nginx cache + logrotate config"
+REPO_DEPLOY="$APP_ROOT/current/deploy"
+if [ -d "$REPO_DEPLOY/nginx" ]; then
+  install -m 0644 "$REPO_DEPLOY/nginx/conf.d/"*.conf /etc/nginx/conf.d/
+  # Do not clobber hot-pages: it is edited in place between deploys to add or
+  # retire campaign links, so only seed it when absent.
+  for f in "$REPO_DEPLOY/nginx/snippets/"*.conf; do
+    base="$(basename "$f")"
+    if [ "$base" = "ladill-link-hot-pages.conf" ] && [ -f "/etc/nginx/snippets/$base" ]; then
+      log "  keeping existing snippets/$base"
+      continue
+    fi
+    install -m 0644 "$f" "/etc/nginx/snippets/$base"
+  done
+  mkdir -p /var/cache/nginx/ladill-link
+  chown www-data:www-data /var/cache/nginx/ladill-link
+fi
+if [ -f "$REPO_DEPLOY/logrotate/ladill-laravel" ]; then
+  install -m 0644 "$REPO_DEPLOY/logrotate/ladill-laravel" /etc/logrotate.d/ladill-laravel
+fi
+
 log "Configuring nginx for ladl.link"
 LADL_CONF="/etc/nginx/sites-available/ladl.link.conf"
 if [ ! -f "$LADL_CONF" ]; then
@@ -83,6 +104,7 @@ server {
     server_name ladl.link www.ladl.link;
     root /var/www/ladill-link/current/public;
     location ^~ /.well-known/acme-challenge/ { allow all; }
+    include snippets/ladill-link-public-cache.conf;
     location / { try_files $uri $uri/ /index.php?$query_string; }
     location ~ \.php$ {
         include snippets/fastcgi-php.conf;
@@ -117,6 +139,7 @@ server {
     ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
     root /var/www/ladill-link/current/public;
     index index.php;
+    include snippets/ladill-link-public-cache.conf;
     location / { try_files $uri $uri/ /index.php?$query_string; }
     location ~ \.php$ {
         include snippets/fastcgi-php.conf;
@@ -155,3 +178,13 @@ fi
 
 log "Bootstrap complete"
 curl -sI "https://link.ladill.com/up" 2>/dev/null | head -3 || curl -sI "http://link.ladill.com/up" 2>/dev/null | head -3 || true
+
+# Existing servers were provisioned before the cache existed, and the vhost above
+# is only written when absent. Patch the include in rather than rewriting a file
+# that may carry local edits.
+if [ -f "$LADL_CONF" ] && ! grep -q "ladill-link-public-cache.conf" "$LADL_CONF"; then
+  log "Adding cache include to existing ladl.link vhost"
+  cp "$LADL_CONF" "$LADL_CONF.bak-$(date +%Y%m%d-%H%M%S)"
+  sed -i 's|^\( *\)location / { try_files \$uri \$uri/ /index.php?\$query_string; }|\1include snippets/ladill-link-public-cache.conf;\n\1location / { try_files $uri $uri/ /index.php?$query_string; }|' "$LADL_CONF"
+  nginx -t && systemctl reload nginx || log "WARN: nginx test failed; restore from $LADL_CONF.bak-*"
+fi