fix(hub): revalidate static assets so a split SPA version cannot load

The SPA became a module graph that has to agree with itself: app.js
imports i18n.js, which imports a catalogue from locales/. Serving one of
them from cache while fetching another is not a stale page, it is a broken
one, and both directions were reproduced:

- a browser holding the previous i18n.js fails to *link* the new app.js
  ("does not provide an export named 'initLocale'"). That happens before
  any code runs, so the fallback in the boot cannot catch it — blank page.
- the reverse pairing links and renders, but nothing calls initLocale(),
  so every string comes out as its own key: nav.logout, group.tab_files.

Starlette sends only etag and last-modified, and with no explicit
freshness a browser is entitled to guess one — roughly 10% of the age
since last-modified, which is comfortably long enough to catch a deploy.
Caddy is a plain reverse proxy and adds nothing.

`no-cache` does not disable caching; it requires a conditional request,
which the existing ETag answers with a 304 and no body. Measured: 304,
0 bytes, on every static path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

0 files changed, 0 insertions, 0 deletions