Lang menu and autodetect

site/nginx.conf

@@ -1,9 +1,46 @@
+# Auto-detect language from the browser's Accept-Language header, no JS
+# involved (site stays static/no-JS per config.toml). Only the exact "/" is
+# affected — deep links (e.g. someone shares /es/legal/rules/) are untouched.
+# Fires once per visitor: a "tane_visited" cookie (set on every response) is
+# checked first, so a later visit to "/" — including clicking "English" from
+# the switcher on a non-English browser — is never redirected again.
+map $http_accept_language $tane_lang {
+    default en;
+    ~*^es es;
+    ~*^pt pt;
+}
+
+map $http_cookie $tane_seen {
+    default 0;
+    "~*tane_visited=1" 1;
+}
+
 server {
     listen 80;
     server_name _;
     root /usr/share/nginx/html;
     index index.html;
 
+    # Non-sensitive, no PII: only remembers "this browser has been here
+    # before" so the auto-redirect below doesn't repeat. No Secure flag since
+    # the value carries no sensitive data and this must also work over plain
+    # http in local/dev previews; TLS is terminated upstream in production.
+    add_header Set-Cookie "tane_visited=1; Path=/; Max-Age=31536000; SameSite=Lax" always;
+
+    location = / {
+        set $tane_redirect "";
+        if ($tane_seen = 0) {
+            set $tane_redirect $tane_lang;
+        }
+        if ($tane_redirect = en) {
+            set $tane_redirect "";
+        }
+        if ($tane_redirect != "") {
+            return 302 /$tane_redirect/;
+        }
+        try_files /index.html =404;
+    }
+
     # Security headers. The page is fully static and self-contained: inline CSS
     # (needs style-src 'unsafe-inline'), same-origin images (+ data: URIs), no
     # third-party scripts. HSTS is host-scoped (no includeSubDomains) so it can't