Enable brotli compression for API and static files

- Add compression-br feature to tower-http
- Apply CompressionLayer to API routes (JSON responses)
- Apply CompressionLayer to static files (CSS, JS, locales)
- File downloads remain uncompressed (avoid double compression)

src/interfaces/api/routes.rs

@@ -358,7 +358,8 @@ pub fn create_api_routes(app_state: &AppState) -> Router<AppState> {
     let admin_router = admin_handler::admin_routes().with_state(app_state.clone());
     router = router.nest("/admin", admin_router);
 
+    // Compression for API responses (JSON) — excludes file downloads
     router
-        .layer(CompressionLayer::new())
+        .layer(CompressionLayer::new().br(true).gzip(true))
         .layer(TraceLayer::new_for_http())
 }

src/interfaces/web/mod.rs

@@ -13,7 +13,7 @@ pub fn create_web_routes() -> Router<AppState> {
     let static_path = config.static_path.clone();
 
     // Static assets (JS, CSS, JSON, SVG, ICO) served via ServeDir
-    // with gzip compression and aggressive caching (7 days).
+    // with brotli + gzip compression and aggressive caching (7 days).
     // HTML pages are served via explicit routes (include_str!) and
     // do NOT pass through these layers.
     let static_service = ServeDir::new(static_path);
@@ -26,7 +26,7 @@ pub fn create_web_routes() -> Router<AppState> {
         .route("/shared", get(serve_shared_page))
         // Serve static files with compression + cache headers
         .fallback_service(static_service)
-        .layer(CompressionLayer::new())
+        .layer(CompressionLayer::new().br(true).gzip(true))
         .layer(SetResponseHeaderLayer::if_not_present(
             CACHE_CONTROL,
             HeaderValue::from_static("public, max-age=604800, stale-while-revalidate=86400"),