media.comfy.org serves hub media at max-age=3600, not the 1 year the pipeline sets

Follow-up from #1216 (GTM-265), which introduced `media.comfy.org/hub-media/`.

## The pipeline asks for a year; readers get an hour

`site/scripts/hub-media/*.mjs` upload every object with `--cache-control=public, max-age=31536000, immutable`, and the objects really do carry that. But the CDN in front of the bucket rewrites it.

```
$ curl -sI https://storage.googleapis.com/comfy-org-videos/hub-media/video/.mp4
cache-control: public, max-age=31536000, immutable # origin object

$ curl -sI https://media.comfy.org/hub-media/video/.mp4
cache-control: public,max-age=3600,immutable # what a browser sees
via: 1.1 google
age: 118
```

Checked across 60 objects — 20 videos, 20 posters, 20 images — and it is **uniform**: every one is served `max-age=3600`, every response carries `via: 1.1 google`. That points at a Cloud CDN backend bucket whose `cdnPolicy` sets `clientTtl`/`defaultTtl` to 3600 and so overrides the origin header.

## Why it matters here specifically

These assets are keyed by the upstream asset UUID and are immutable by construction — a new encode gets a new id, it never overwrites one. That is precisely the case `max-age=31536000, immutable` exists for. At 3600 a returning reader re-validates every hero, poster and card image once an hour instead of once a year, which gives back part of what #1216 bought on repeat visits and on cross-page navigation within the hub.

`immutable` is still being sent, so within any given hour there is no revalidation. The loss is at the hour boundary, not continuous.

## Fix

Not a code change in this repo — the upload flags are already correct. On the Cloud CDN backend bucket for `comfy-org-videos`, either set `cacheMode: USE_ORIGIN_HEADERS` so the object's own `Cache-Control` wins, or raise `clientTtl`/`defaultTtl` to match.

Worth confirming the same policy is not also capping the other assets served from that bucket.

_{Filed while reviewing #1216. Measurements are reproducible with the two curls above.}

Start by reviewing site/scripts/hub-media/*.mjs and reproduce the origin and CDN headers with the two curl requests in the issue. Then inspect the Cloud CDN backend bucket for comfy-org-videos and confirm its cache policy, including assets beyond hub-media. Done means the CDN serves the immutable objects with a one-year max-age without changing the upload flags.

Written by the indexing model from the issue text.