Add Cloudflare Pages cache headers for static assets

Cloudflare Pages currently serves all responses with the default
'Cache-Control: public, max-age=0, must-revalidate', including
content-hashed files under /assets/* produced by the Docusaurus
build. Add a static/_headers file so Cloudflare Pages applies
long-lived immutable caching to /assets/* (safe because the filename
changes whenever the content changes) and a conservative one-day
max-age to /img/* and /images/*, which keep stable filenames and can
be replaced in place.

Also exclude _headers from the aws s3 sync step in the publish
workflow, since it is only meaningful for the Cloudflare deployment
and would otherwise be uploaded to S3/CloudFront and become publicly
accessible at /_headers there.

static/_headers

@@ -0,0 +1,17 @@
+# Cloudflare Pages cache headers (only applies to the Cloudflare deployment,
+# see .gitea/workflows/build-and-publish.yaml for the S3/CloudFront exclude)
+
+# Docusaurus content-hashed build output (webpack chunks, css, etc). The
+# filename changes whenever the content changes, so it is safe to cache
+# these for a long time and mark them immutable.
+/assets/*
+  Cache-Control: public, max-age=31536000, immutable
+
+# Files under static/img and static/images keep stable filenames and can be
+# replaced in place (same name, new content), so use a short, conservative
+# max-age instead of immutable caching.
+/img/*
+  Cache-Control: public, max-age=86400
+
+/images/*
+  Cache-Control: public, max-age=86400