Compression across the board: directory answers, uploads, metrics, traces, the page (#253)

Measured 2026-10-16, uncompressed until now: the directory's answers (the feed list ipx reads,
603 KB of JSON, ~134 ms of a 159 ms Directory request), ipx's snapshot upload (~100 KB each half
hour), both /metrics (4.7 and 0.9 KB every 15 s) and every trace export to Tempo. Already
compressed: ipx-web's answers (zstd, #239), the home page and the directory's public pages
through Cloudflare (brotli, zstd).

- The directory compresses with brotli, zstd or gzip as asked, and unpacks a gzipped request.
- ipx sends its snapshot gzipped; the directory is deployed first.
- Both /metrics answer gzipped, as Prometheus asks.
- opentelemetry-otlp's gzip-http: OTEL_EXPORTER_OTLP_COMPRESSION=gzip compresses the export, set
  for all three in production's compose file; Caddy's exporter reads the same variable.
- web/build.mjs writes .br (quality 11) and .gz (level 9) beside each text file, and Caddy serves
  them in place (file_server precompressed): app.js 30 KB where zstd on the fly gave 37, app.css
  11 where 14. A .br or .gz asked for by name is refused, or /admin.js.br would be the admin
  page's script without the check that keeps it to admins; in a handle of its own, since a bare
  respond runs after the handles.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/ui/app.spec.js

@@ -2054,3 +2054,17 @@ test('Currently Listening and the Directory show at once once seen, with a spinn
   }
   await page.unroute(slow);
 });
+
+test('the page comes compressed, and the compressed copies cannot be asked for by name', async ({ page }) => {
+  // #253: brotli made at build, served in place of the file.
+  const js = await page.request.get('/app.js', { headers: { 'Accept-Encoding': 'br, gzip' } });
+  expect(js.status()).toBe(200);
+  expect(js.headers()['content-encoding']).toBe('br');
+  expect(js.headers()['content-type']).toContain('javascript');
+  const gz = await page.request.get('/app.css', { headers: { 'Accept-Encoding': 'gzip' } });
+  expect(gz.headers()['content-encoding']).toBe('gzip');
+  // The admin page's script, under its compressed name, would skip the check that keeps it to admins.
+  for (const p of ['/admin.js.br', '/admin.html.gz', '/app.js.br']) {
+    expect((await page.request.get(p)).status(), p).toBe(404);
+  }
+});