Quote the size a visitor actually pays

The Play button said "about 3.0 MB". That is the gzipped total, and no public
visitor gets it: NPM on the VPS blanks Accept-Encoding for every proxied
request at its own nginx.conf:44, so cyrion's gzip_static is never asked and
answers raw. The real cost is about 9 MB, and a button whose entire purpose is
to be honest about the download was understating it threefold.

It now quotes rawBytes. Overstating is the safe direction, and this goes back
to wireBytes -- a third of the size -- if NPM is ever made to pass the header
through. Falls back to wireBytes for an export made before rawBytes existed.

Also puts a warning at the top of nginx.conf. It is bind-mounted as a single
FILE, so the inode is pinned and `git pull` gives the file a new one the
running container never sees; nothing in auto-build.sh recreates it. The
gzip_static rule added an hour ago was not live until the container was
force-recreated by hand, and the build was green the whole time.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01S4wdbGSVzvUDHBWRjSVxfr

deploy/nginx.conf

@@ -1,3 +1,12 @@
+# ⚠️ An edit here is NOT live until the container is recreated:
+#   docker compose -f deploy/docker-compose.yml up -d --force-recreate garden
+# This file is bind-mounted as a single FILE, which pins its inode, so the
+# `git pull` at the top of every build tick replaces it with a new inode the
+# running container never sees. auto-build.sh only builds dist/ -- nothing in
+# the automated path touches compose. The build goes green and the config
+# simply is not live; `docker exec garden grep ... /etc/nginx/conf.d/default.conf`
+# is how you tell.
+
 server {
     listen 80;
     server_name _;