perf: CDN-ready caching headers and compression

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/app.ts

@@ -52,6 +52,28 @@ app.use('/api/*', bodyLimit({ maxSize: 256 * 1024 }))
 // Rate limit all POST endpoints (60/min per IP)
 app.use('/api/*', rateLimit(60_000, 60))
 
+// API cache headers
+app.use('/api/*', async (c, next) => {
+  await next()
+  // Default: no-store for dynamic data
+  if (!c.res.headers.has('Cache-Control')) {
+    c.header('Cache-Control', 'no-store')
+  }
+})
+// Leaderboard and public stats can be cached briefly
+app.use('/api/bots/leaderboard', async (c, next) => {
+  await next()
+  c.header('Cache-Control', 'public, max-age=60')
+})
+app.use('/api/stats/public', async (c, next) => {
+  await next()
+  c.header('Cache-Control', 'public, max-age=300')
+})
+app.use('/api/docs/*', async (c, next) => {
+  await next()
+  if (c.req.method === 'GET') c.header('Cache-Control', 'public, max-age=3600')
+})
+
 app.get('/api/health', (c) => c.json({ status: 'ok', name: 'botfights' }))
 
 app.route('/api/auth', authRouter)