perf: defer non-critical CSS and extend cache headers

Targets the render-blocking and cache-lifetime Unlighthouse findings:

- baseof.html: Font Awesome, Prism, alerts, code-copy, and Algolia
  stylesheets now load via the print-media swap (media=print +
  onload) instead of blocking first paint. Only the critical
  fingerprinted Tailwind bundle remains render-blocking. A <noscript>
  block preserves the blocking links when JS is disabled.
- netlify.toml: add Cache-Control for fonts (immutable 1y, they are
  content-hashed) and images (30d, not fingerprinted).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: HeyItsGilbert

netlify.toml

@@ -29,3 +29,50 @@
   for = "/*.js"
   [headers.values]
     Cache-Control = "public, max-age=31536000, immutable"
+
+# Fonts are fingerprinted by Hugo (content hash in filename) — safe to cache forever.
+[[headers]]
+  for = "/*.ttf"
+  [headers.values]
+    Cache-Control = "public, max-age=31536000, immutable"
+
+[[headers]]
+  for = "/*.woff2"
+  [headers.values]
+    Cache-Control = "public, max-age=31536000, immutable"
+
+# Images are not fingerprinted — cache for 30 days without immutable so updates propagate.
+[[headers]]
+  for = "/*.png"
+  [headers.values]
+    Cache-Control = "public, max-age=2592000"
+
+[[headers]]
+  for = "/*.jpg"
+  [headers.values]
+    Cache-Control = "public, max-age=2592000"
+
+[[headers]]
+  for = "/*.jpeg"
+  [headers.values]
+    Cache-Control = "public, max-age=2592000"
+
+[[headers]]
+  for = "/*.svg"
+  [headers.values]
+    Cache-Control = "public, max-age=2592000"
+
+[[headers]]
+  for = "/*.webp"
+  [headers.values]
+    Cache-Control = "public, max-age=2592000"
+
+[[headers]]
+  for = "/*.gif"
+  [headers.values]
+    Cache-Control = "public, max-age=2592000"
+
+[[headers]]
+  for = "/*.ico"
+  [headers.values]
+    Cache-Control = "public, max-age=2592000"

themes/powershell-community/layouts/_default/baseof.html

@@ -86,14 +86,25 @@
     {{ if .IsHome }}{{ partial "schema-site.html" . }}{{ end }}
     {{ if and .IsPage (in (slice "articles" "podcast") .Section) }}{{ partial "schema-article.html" . }}{{ end }}
 
-    <!-- CSS — Tailwind purged against the built site, minified + fingerprinted -->
+    <!-- Critical CSS — Tailwind purged against the built site, minified + fingerprinted (render-blocking by design) -->
     {{ $tailwind := resources.Get "css/tailwind.css" | minify | fingerprint }}
     <link href="{{ $tailwind.RelPermalink }}" rel="stylesheet">
-    <link href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/all.min.css" rel="stylesheet">
-    <link href="https://cdnjs.cloudflare.com/ajax/libs/prism/1.24.1/themes/prism-tomorrow.min.css" rel="stylesheet">
-    <link href="/css/alerts.css" rel="stylesheet">
-    <link href="/css/code-copy.css" rel="stylesheet">
-    {{ with .Site.Params.algolia }}<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@algolia/algoliasearch-netlify-frontend@1/dist/algoliasearchNetlify.css" />{{ end }}
+
+    <!-- Non-critical CSS — loaded async via the print-media swap so it doesn't block first paint -->
+    {{- $asyncCSS := slice
+        "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.0.0/css/all.min.css"
+        "https://cdnjs.cloudflare.com/ajax/libs/prism/1.24.1/themes/prism-tomorrow.min.css"
+        "/css/alerts.css"
+        "/css/code-copy.css" -}}
+    {{- with .Site.Params.algolia }}{{ $asyncCSS = $asyncCSS | append "https://cdn.jsdelivr.net/npm/@algolia/algoliasearch-netlify-frontend@1/dist/algoliasearchNetlify.css" }}{{ end -}}
+    {{ range $asyncCSS }}
+    <link rel="stylesheet" href="{{ . }}" media="print" onload="this.media='all'">
+    {{- end }}
+    <noscript>
+        {{- range $asyncCSS }}
+        <link rel="stylesheet" href="{{ . }}">
+        {{- end }}
+    </noscript>
 
     <!-- Self-hosted Inter (replaces render-blocking Google Fonts @import) -->
     <style>