docs: nixos and binary cache

fix: cache headers and add etags

docs: nixos and binary cache

fix(ci): use kaniko to build

feat(tranquil-store): gc and hardening

fix(auth): keep lxm optional and dont default to * when no lxm is given in getServiceAuth

feat(test): test that websockets get closed

fix(pds): do service identifier resolution for proxying correctly