homepage: revalidate assets so deploys never serve stale CSS/JS

The board rendered vertically for a user whose browser had cached the
pre-sectioning style.css: deploys overwrite /srv/homepage in place, and
nothing told the browser to revalidate. The @home handler on the post-auth
listener now sends Cache-Control: no-cache, so every load is an ETag
round-trip (a cheap 304 when unchanged) and a deploy is always visible on
the next navigation.

dankclaw/Caddyfile

@@ -309,6 +309,10 @@ http://:8017 {
 	@home host www.franksdank.cloud
 	handle @home {
 		root * /srv/homepage
+		# Deploys overwrite /srv/homepage in place; without revalidation a
+		# browser keeps serving the pre-deploy CSS/JS/HTML. no-cache forces an
+		# ETag round-trip on every load (a cheap 304 when unchanged).
+		header Cache-Control "no-cache"
 		# RBAC (2026-09-01): /admin requires membership in the homepage-admins
 		# authentik group. In proxy-provider mode the outpost injects
 		# X-Authentik-Groups on its upstream request to this listener and strips

tests/homepage_caddy.bats

@@ -33,6 +33,14 @@ setup() {
     grep -qE "handle[[:space:]]+@data" "$CADDY"
 }
 
+@test "the homepage revalidates its assets (no stale cache after deploys)" {
+    # Deploys overwrite /srv/homepage in place; without a revalidation header
+    # a browser keeps serving the pre-deploy CSS/JS/HTML from cache.
+    local block
+    block=$(awk '/handle @home \{/,/^\t\}$/' "$CADDY")
+    echo "$block" | grep -q 'header Cache-Control "no-cache"'
+}
+
 @test "the homepage vhost chains Anubis (public) before Authentik SSO (internal listener)" {
     # Public listener: www proxies everything through Anubis; the naked
     # domain never enters the chain (it redirects at the TLS edge first).