Set AIA proxy cache to immutable with 1-year max-age

AIA certificates at a given URL never change — a CA will not serve
different DER bytes at the same endpoint. Use max-age=31536000 with
immutable directive to cache permanently at both Cloudflare edge and
browser level.

Author: danielewood

web/functions/api/fetch.ts

@@ -196,8 +196,8 @@ export const onRequestGet: PagesFunction = async ({ request }) => {
       responseHeaders.set("Content-Type", "application/octet-stream");
       responseHeaders.set("Content-Length", body.byteLength.toString());
       responseHeaders.set("X-Content-Type-Options", "nosniff");
-      // Cache certificate responses for 1 hour — they rarely change
-      responseHeaders.set("Cache-Control", "public, max-age=3600");
+      // Cache forever — AIA certificates are immutable (same URL = same cert)
+      responseHeaders.set("Cache-Control", "public, max-age=31536000, immutable");
 
       return new Response(body, { status: 200, headers: responseHeaders });
     } catch {