QA release: backend 1.1.21, frontend 1.1.68 (re-cut)

Same version numbers as release-be1.1.21-fe1.1.68; the frontend image was
rebuilt, so the 1.1.68 tag now resolves to a different digest:

  old  sha256:5881f495b872dd7...
  new  sha256:4c182e14cc0e201582c07767a1840297e00fd043f6a78acaa1fa3ff97e2ad57a

What changed in the image (web loading time):
- main.dart.js and flutter_bootstrap.js are stamped with ?v=<build hash>
  and served immutable for 30 days. They were previously sent
  no-cache, no-store, so a ~2.6 MB gzipped bundle was re-downloaded on
  every page view - about 7 s on the prod link.
- The app shell, service workers, yt_player.html and the asset manifests
  revalidate (no-cache), so a repeat load is a 304 rather than a full
  download, and a new release is still picked up immediately.
- Removed a render-blocking <script> that pulled livekit-client from
  unpkg on every cold load; it was unpinned and had begun returning 404,
  and the global it defined is referenced nowhere.
- nginx gzip_comp_level 6 (was nginx's default of 1): the bundle drops
  from 2,648,518 to 2,168,809 bytes on the wire.

No .env, compose or host-nginx changes are needed - everything is inside
the frontend image. Deploy is the usual pull + up -d for frontend.
This tag has no release notes.