Move Cloudflare cache headers to cloudflare/_headers and cover locale copies

static/_headers was removed by 'make clean' (rm -rf static/_*) and got
copied into every non-default locale's build output, where it had no
effect since none of its rules matched locale-prefixed paths. Move the
file to cloudflare/_headers, which is outside static/ and is copied into
build/_headers by the Cloudflare Pages workflow step, after the S3 sync
step has already run so the file is never uploaded to S3/CloudFront.

Add /:locale/assets/*, /:locale/img/* and /:locale/images/* rules so the
caching also applies to the zh-cn and zh-tw locale copies Docusaurus
produces (docusaurus.config.js locales: en-us, zh-cn, zh-tw), which were
still falling back to Cloudflare's default max-age=0 caching. A named
placeholder is used instead of a second '*' splat or an explicit list of
locales, since Cloudflare Pages only allows one splat per path and this
way the rule keeps matching if a locale is ever added or removed.

Revert the earlier aws s3 sync --exclude "_headers" change: with
_headers no longer living under static/, it is never present in build/
at S3 sync time, so the exclude has nothing to do.

static/_headers

@@ -1,17 +0,0 @@
-# Cloudflare Pages cache headers (only applies to the Cloudflare deployment,
-# see .gitea/workflows/build-and-publish.yaml for the S3/CloudFront exclude)
-
-# Docusaurus content-hashed build output (webpack chunks, css, etc). The
-# filename changes whenever the content changes, so it is safe to cache
-# these for a long time and mark them immutable.
-/assets/*
-  Cache-Control: public, max-age=31536000, immutable
-
-# Files under static/img and static/images keep stable filenames and can be
-# replaced in place (same name, new content), so use a short, conservative
-# max-age instead of immutable caching.
-/img/*
-  Cache-Control: public, max-age=86400
-
-/images/*
-  Cache-Control: public, max-age=86400