Keep HeyCatch short links on the public host (#46)

## Summary
- `master` already contains the 124 public-page nginx (crawler files, exact HTML paths, 404 page, security headers) and the shortlink redirect that published port 8082.
- This branch merges that `master` and keeps one change: `absolute_redirect off` on `/f`, `/h`, `/i`, `/l`, `/r`, `/x`, and `/y`, including an optional trailing slash.
- One deploy after merge. No separate 124 deploy. `chat_web_app` is unchanged.

## Test plan
- [ ] Merge, then apply the web-static role on a prod host.
- [ ] `curl -sI https://hesychia.ai/y` returns `302` and `Location: /?utm_source=heycatch&utm_campaign=y` (no `:8082`).
- [ ] Same check for `/f`, `/h`, `/i`, `/l`, `/r`, and `/x`.
- [ ] `https://hesychia.ai/robots.txt` still returns the crawler file, not the app shell.

Reviewed-on: #46

roles/web-static/templates/nginx.conf.j2

@@ -95,8 +95,12 @@ server {
 {% endif %}
 
 {% if a.name == 'chat_web_app' and a.env == 'prod' %}
-    # HeyCatch short links. Unknown paths 404, so the SDK never sees /x.
+    # HeyCatch short links.
-    location ~ ^/([a-z0-9])$ {
+    # f Facebook, h Threads, i Instagram, l LinkedIn, r Reddit, x X, y YouTube.
+    # Relative Location: this vhost listens on the container port. An absolute
+    # redirect would publish that port (hesychia.ai:8082).
+    location ~ ^/([a-z0-9])/?$ {
+        absolute_redirect off;
         return 302 /?utm_source=heycatch&utm_campaign=$1;
     }
 {% endif %}