Allow Android beta update reads

[jieChris]

Summary

• allow public cross-origin reads only for /downloads/android/beta/
• keep API and all other site resources unchanged
• cover the production Nginx contract with a unit test

Root cause

The Android Capacitor WebView runs at https://localhost, so browser CORS blocked the public beta manifest before version comparison.

Verification

• npx vitest run tests/unit/nginx-cache-policy.spec.ts
• git diff --check
• deployment workflow validates the Nginx config with nginx -t before activation