Practical CyberPanel setup for a privacy-first self-assessment web app

I am preparing a small privacy-first questionnaire application for deployment behind CyberPanel and OpenLiteSpeed. The reference implementation is the RAADS Test: most questionnaire logic runs in the browser, static assets can be cached aggressively, and results should not be stored in ordinary access logs beyond what is operationally necessary.

I would appreciate feedback on a clean production configuration for this pattern:

1. Cache versioned JavaScript, CSS, fonts, and images for a long period while keeping the HTML shell on a shorter cache lifetime.
2. Avoid caching any optional result-sharing route or query-string variant that may contain user-specific state.
3. Add practical CSP, Referrer-Policy, Permissions-Policy, HSTS, and frame-ancestor headers without breaking normal browser execution.
4. Minimize and rotate logs while retaining enough information for rate limiting and incident response.

Would you implement these rules mainly through OpenLiteSpeed rewrite/context settings, or keep the security headers and no-cache routes in the vhost include? I am also interested in any CyberPanel backup or staging settings that help prevent private result routes from being copied into a public test environment.