chore(build): silence NFT-trace warnings and ship the bfcache header

Two additive `next.config.ts` tweaks for v1.4.34:

- `outputFileTracingExcludes: { "*": ["./next.config.ts"] }` — silences
  the Turbopack tracer warnings emitted during `next build`. The tracer
  follows the `MAXMIND_LICENSE_KEY` env access in `src/lib/geo.ts` back
  into the config file and emits "cannot be traced" warnings for every
  path it tried to walk afterwards. The standalone bundle is still
  controlled by `output: "standalone"`; the exclude only narrows trace
  reporting and has no runtime effect.

- A second `headers()` rule (source: `/((?!api|_next).*)`) stamps
  `Cache-Control: private, max-age=0, must-revalidate` on every
  authenticated HTML page response. The Next.js framework default for
  pages that touch cookies is `no-store, must-revalidate`, which
  Chromium counts as a hard bfcache breaker; the rule above replaces
  that on the page tree while leaving `/api/*` and `/_next/*` alone so
  API routes keep their explicit directives and static assets keep
  immutable caching. Pairs with the `Permissions-Policy: unload=()`
  hint already in place to restore back/forward-cache eligibility for
  every authed route.

next.config.ts

@@ -27,6 +27,21 @@ const nextConfig: NextConfig = {
   // bfcache restore path stays clear. The other CSP-style security
   // headers already live on the response via the standalone runtime;
   // we add only the bfcache hint here.
+  //
+  // v1.4.34 IW-A — second rule layers the bfcache-friendly
+  // `Cache-Control` directive onto every authenticated HTML page
+  // response (the source negative-lookahead excludes `/api/*` and
+  // `/_next/*` so static assets keep their immutable caching and API
+  // routes keep their explicit headers). The framework default for
+  // pages that read cookies is `no-store, must-revalidate`, which
+  // Chromium counts as a hard bfcache breaker. `private, max-age=0,
+  // must-revalidate` keeps shared caches out (proxies, CDNs cannot
+  // store personal data), still forces revalidation on every
+  // navigation so session swaps detect on the wire, and is
+  // bfcache-eligible — back/forward navigation restores the page
+  // from memory instead of paying a full reload. See
+  // `src/lib/http/cache-headers.ts` for the typed constant reused by
+  // route handlers that opt into the same posture.
   async headers() {
     return [
       {
@@ -35,6 +50,15 @@ const nextConfig: NextConfig = {
           { key: "Permissions-Policy", value: "unload=()" },
         ],
       },
+      {
+        source: "/((?!api|_next).*)",
+        headers: [
+          {
+            key: "Cache-Control",
+            value: "private, max-age=0, must-revalidate",
+          },
+        ],
+      },
     ];
   },
   serverExternalPackages: [
@@ -53,6 +77,16 @@ const nextConfig: NextConfig = {
   outputFileTracingIncludes: {
     "*": ["./src/lib/ai/prompts/safety-contracts.*.yaml"],
   },
+  // v1.4.34 IW-A — silence the Turbopack NFT trace warnings emitted
+  // during `next build`. The tracer follows the `MAXMIND_LICENSE_KEY`
+  // env access in `src/lib/geo.ts` back into the config file, then
+  // emits "cannot be traced" warnings for paths it tried to walk
+  // (next.config.ts → mood-entries/bulk route, etc.). The standalone
+  // bundle is controlled by `output: "standalone"` above; this exclude
+  // only narrows trace reporting and has no runtime effect.
+  outputFileTracingExcludes: {
+    "*": ["./next.config.ts"],
+  },
   experimental: {
     optimizePackageImports: ["recharts", "lucide-react"],
   },