Tor first loads drop from ~25 MB raw to ~5 MB on the wire; prod build writes .wasm.br sidecars and Alpine nginx serves them under /assets with long-lived cache.
Multi-stage frontend embed, envsubst entrypoint for TLS vhosts and upload body limits, shared locations with minimal response headers and zero access logs.
nobswebdev