Move Cloudflare cache headers to cloudflare/_headers and cover locale copies

static/_headers was removed by 'make clean' (rm -rf static/_*) and got
copied into every non-default locale's build output, where it had no
effect since none of its rules matched locale-prefixed paths. Move the
file to cloudflare/_headers, which is outside static/ and is copied into
build/_headers by the Cloudflare Pages workflow step, after the S3 sync
step has already run so the file is never uploaded to S3/CloudFront.

Add /:locale/assets/*, /:locale/img/* and /:locale/images/* rules so the
caching also applies to the zh-cn and zh-tw locale copies Docusaurus
produces (docusaurus.config.js locales: en-us, zh-cn, zh-tw), which were
still falling back to Cloudflare's default max-age=0 caching. A named
placeholder is used instead of a second '*' splat or an explicit list of
locales, since Cloudflare Pages only allows one splat per path and this
way the rule keeps matching if a locale is ever added or removed.

Revert the earlier aws s3 sync --exclude "_headers" change: with
_headers no longer living under static/, it is never present in build/
at S3 sync time, so the exclude has nothing to do.

.gitea/workflows/build-and-publish.yaml

@@ -39,13 +39,20 @@ jobs:
           aws-region: ${{ secrets.AWS_REGION}}
       - name: Copy files to the production website with the AWS CLI
         run: |
-          aws s3 sync build/ s3://docs-gitea-com --exclude "_headers"
+          aws s3 sync build/ s3://docs-gitea-com
           aws cloudfront create-invalidation --distribution-id ${{ secrets.AWS_DISTRIBUTION}} --paths '/*'
       - name: Copy files to Cloudflare Pages
         env:
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
         run: |
+          # cloudflare/_headers is only meaningful for the Cloudflare Pages
+          # deployment, so it is copied into build/ here, after the S3 sync
+          # step above has already run. If it were placed in build/ any
+          # earlier, that S3 sync would publish it to S3/CloudFront and make
+          # it publicly accessible at /_headers there.
+          cp cloudflare/_headers build/_headers
+          test -f build/_headers || exit 1
           pnpm dlx wrangler@4 pages deploy build \
             --project-name docs-gitea-com \
             --branch main