Renamed the Web package as Infrastructure (#25)

This PR contains the work done to rename the _Web_ package as _Infrastructure_, to provide a clear naming and purpose to this particular package within the project.

To provide further details about the work:

* Infrastructure
  * Asset fingerprinting: an FNV-1a token derived from the static files directory, appended as ?v= to asset URLs so deploys bust caches; pre-rendered pages also revalidate via weak ETags.
  * New middlewares: fixed-window RateLimitMiddleware (per-client budgets keyed by trusted X-Forwarded-For or remote address) and VaryMiddleware (Accept-Encoding on every response); SecurityHeadersMiddleware now also stamps error responses.
  * Auto-generated HEAD endpoints, cache max-age configuration, and Docker build/Compose refinements.
  * Protocols and scaffolding: Asset/AssetExtension, the Page protocol (viewport, stylesheets, scripts, versioned URLs), and LocalizedRequestContext.
  * Rate limiter's counter store swapped from an actor to a Mutex (no executor hop per request) with amortized batch eviction instead of O(n²) scans under client floods.
  * FingerprintAssets reports unreadable files to a logger instead of silently producing a token that never busts their cache.

Reviewed-on: rock-n-code/loud-amsterdam#25
Co-authored-by: Javier Cicchelli <javier@rock-n-code.com>
Co-committed-by: Javier Cicchelli <javier@rock-n-code.com>

Services/Website/Sources/App/Extensions/ConfigReader+Properties.swift

@@ -1,5 +1,6 @@
 import Configuration
 import Hummingbird
+import Infrastructure
 import Logging
 import Persistence
 import WebsiteLibrary
@@ -15,9 +16,16 @@ package extension ConfigReader {
 
     /// The `Cache-Control` policy applied to static files, grouped by media type.
     ///
-    /// The max-ages are read from the `cache.maxAge.text`, `cache.maxAge.image`, and `cache.maxAge.default` keys. Text files (CSS,
-    /// JavaScript, plain text) additionally require revalidation once stale; images and everything else are served public with their max-age alone.
+    /// The max-ages are read from the `cache.maxAge.asset`, `cache.maxAge.text`, `cache.maxAge.image`, and
+    /// `cache.maxAge.default` keys. Stylesheets and scripts are referenced through fingerprinted URLs (see `FingerprintAssets`) and
+    /// fonts are immutable subset files, so all three are served long-lived and `immutable` — a deploy busts them by changing the URL, never by
+    /// revalidation. The remaining text files (e.g. `robots.txt`) keep their unversioned URLs and require revalidation once stale; images and
+    /// everything else are served public with their max-age alone. The groups match in order, so the specific types precede the `text` category.
     var cacheControl: CacheControl {
+        let maxAgeAsset = int(
+            forKey: .Cache.maxAgeAsset,
+            default: .Cache.maxAgeAsset
+        )
         let maxAgeDefault = int(
             forKey: .Cache.maxAgeDefault,
             default: .Cache.maxAgeDefault
@@ -32,6 +40,9 @@ package extension ConfigReader {
         )
 
         return .init([
+            (.textCss, [.public, .maxAge(maxAgeAsset), .immutable]),
+            (.textJavascript, [.public, .maxAge(maxAgeAsset), .immutable]),
+            (.font, [.public, .maxAge(maxAgeAsset), .immutable]),
             (.text, [.public, .maxAge(maxAgeText), .mustRevalidate]),
             (.image, [.public, .maxAge(maxAgeImage)]),
             (.init(type: .any), [.public, .maxAge(maxAgeDefault)]),
@@ -110,6 +121,28 @@ package extension ConfigReader {
         )
     }
 
+    /// The rate limit applied to the subscription endpoint, built from the `rateLimit.*` keys.
+    ///
+    /// `rateLimit.limit` requests are admitted per client per `rateLimit.window` seconds. When
+    /// `rateLimit.trustForwardedFor` is set, clients are keyed by the first `X-Forwarded-For` entry —
+    /// enable it only behind a reverse proxy that sets the header, since clients can forge it otherwise.
+    var rateLimit: RateLimitMiddleware<AppRequestContext>.Configuration {
+        .init(
+            limit: int(
+                forKey: .RateLimit.limit,
+                default: .RateLimit.limit
+            ),
+            window: .seconds(int(
+                forKey: .RateLimit.window,
+                default: .RateLimit.window
+            )),
+            trustForwardedFor: bool(
+                forKey: .RateLimit.trustForwardedFor,
+                default: false
+            )
+        )
+    }
+
     /// The security headers middleware configuration, built from the `security.*` keys.
     ///
     /// Every header value has a default except `Strict-Transport-Security`, which is only sent when `security.strictTransportSecurity`