homepage: revalidate assets so deploys never serve stale CSS/JS

The board rendered vertically for a user whose browser had cached the
pre-sectioning style.css: deploys overwrite /srv/homepage in place, and
nothing told the browser to revalidate. The @home handler on the post-auth
listener now sends Cache-Control: no-cache, so every load is an ETag
round-trip (a cheap 304 when unchanged) and a deploy is always visible on
the next navigation.

tests/homepage_caddy.bats

@@ -33,6 +33,14 @@ setup() {
     grep -qE "handle[[:space:]]+@data" "$CADDY"
 }
 
+@test "the homepage revalidates its assets (no stale cache after deploys)" {
+    # Deploys overwrite /srv/homepage in place; without a revalidation header
+    # a browser keeps serving the pre-deploy CSS/JS/HTML from cache.
+    local block
+    block=$(awk '/handle @home \{/,/^\t\}$/' "$CADDY")
+    echo "$block" | grep -q 'header Cache-Control "no-cache"'
+}
+
 @test "the homepage vhost chains Anubis (public) before Authentik SSO (internal listener)" {
     # Public listener: www proxies everything through Anubis; the naked
     # domain never enters the chain (it redirects at the TLS edge first).