fix(ssr): inject fresh station config into CSR shell to eliminate flash

The CSR shell previously rendered with hardcoded DEFAULT_CONFIG values,
then the client-side API call replaced them 50-500ms later, causing a
visible 'flash of stale content' (wrong colors, wrong station name).

Fix: SSR server fetches live station config from the backend API before
serving the CSR shell, injecting it as:
- Inline <script> seeding window.__STATION_CONFIG (client reads sync)
- Inline <style> setting CSS custom properties (correct colors first paint)

Also adds no-cache Cache-Control headers on HTML page responses to
prevent browsers from caching stale content.

StationConfigService now reads window.__STATION_CONFIG on construction
instead of always starting with DEFAULT_CONFIG.

nginx.conf.template

@@ -78,9 +78,8 @@ http {
     }
 
     # Proxy all page requests to the Angular SSR server.
-    # The SSR server (AngularNodeAppEngine) handles both RenderMode.Server
-    # routes (full on-demand rendering with fresh API data) and serves
-    # prerendered static HTML for RenderMode.Prerender routes.
+    # The SSR server handles both spider SSR rendering and serves CSR shells
+    # to regular users, with fresh station config injected at runtime.
     location / {
         proxy_pass http://ssr_backend;
         proxy_set_header Host $host;
@@ -92,6 +91,10 @@ http {
         # SSR responses should not be cached by intermediate proxies
         proxy_cache off;
         add_header X-Powered-By "Angular SSR" always;
+
+        # Prevent browsers from caching HTML pages — content changes frequently
+        add_header Cache-Control "no-cache, no-store, must-revalidate" always;
+        add_header Pragma "no-cache" always;
     }
 }
 }