Merge claude/2

containers/libreportal/backend/utils/middleware.js

@@ -30,14 +30,16 @@ function noStore(req, res, next) {
 }
 
 // Static-asset options:
-//   - 1h maxAge + ETag on JS/CSS/icons so repeated nav skips a network
-//     round-trip per file. ~25 script tags × ~5ms RTT each adds up otherwise.
-//   - HTML files get Cache-Control: no-cache (still uses ETag, so revalidation
-//     is cheap, but new deploys land immediately without waiting for cache
-//     expiry — the SPA shell is the file most likely to change between deploys).
+//   - 60s maxAge + ETag on JS/CSS/icons. Long enough that rapid in-session
+//     clicks skip the network round-trip, short enough that a deploy is
+//     visible within a minute. Originally tried 1h but that caused stale
+//     cached JS to reference things the new HTML no longer loaded (the
+//     Phase-B lazy-load refactor changed who loads which script).
+//   - HTML files get Cache-Control: no-cache (always revalidates via ETag,
+//     so new deploys land immediately — the SPA shell changes most often).
 //   - dotfiles='ignore' so .auth.json is never served.
 const staticOptions = {
-  maxAge: '1h',
+  maxAge: '60s',
   etag: true,
   dotfiles: 'ignore',
   setHeaders: (res, filePath) => {