SSR /13f/ index (funnel entry). Auth-invariant -> s-maxage.

NOTE: only the trailing-slash /13f/ is served as SSR. The bare /13f is a PRE-EXISTING in-app SPA clean-URL (the thirteen-f.ts browser, pinned by tests/test_spa_shell_asset_resolution_contract.py::[/13f]) — SSR must NOT hijack it. The canonical, sitemap entry, and every internal link point at /13f/, so crawlers index the SSR surface; engaged users keep the in-app view at /13f and /?view=13f. (Deviation from the plan's "serve both forms", forced by the existing SPA route; there is no 307-redirect crawl because both forms return 200.)