Always revalidate the app's files, tell open pages when a newer version exists, and log why a session is refused

An open page kept running the old version after a deploy (the single page never reloads), so the new
People screens did not appear. Static files are now sent with no-cache + ETag (304 when unchanged), icons
are cached for a week, /api/config reports a build stamp, and the app shows "A new version is available -
Reload" when it comes back into view or every 10 minutes. The service worker cache name is bumped.

The server also logs, at most once a minute per reason, why it refused a session cookie (unknown account,
turned off, signed out everywhere, bad signature, expired) without printing the cookie.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

public/app.js

@@ -1535,6 +1535,20 @@ function dirSheet(repo, path, name, dir) {
 // ---- Boot
 (async () => {
   try { cfg = { ...cfg, ...(await (await fetch('/api/config')).json()) }; } catch {}
+  const loadedBuild = cfg.build;
+  // When a new version is deployed, an open page keeps running the old one. Tell the person, and offer a reload.
+  const checkForUpdate = async () => {
+    try {
+      const c = await (await fetch('/api/config', { cache: 'no-store' })).json();
+      if (c.build && loadedBuild && c.build !== loadedBuild && !document.getElementById('upd')) {
+        const b = document.createElement('div'); b.id = 'upd';
+        b.innerHTML = 'A new version of NE Hub is available. <button class="btn" id="updgo">Reload</button>';
+        document.body.appendChild(b); document.getElementById('updgo').onclick = () => location.reload();
+      }
+    } catch {}
+  };
+  document.addEventListener('visibilitychange', () => { if (document.visibilityState === 'visible') checkForUpdate(); });
+  setInterval(checkForUpdate, 10 * 60e3);
   await loadMe();
   await loadSettings();
   addEventListener('hashchange', route);

public/style.css

@@ -246,3 +246,9 @@ html { -webkit-text-size-adjust: 100%; overscroll-behavior: none; }
 body { -webkit-touch-callout: none; }
 button, a, .row { -webkit-user-select: none; user-select: none; }
 input, textarea, [contenteditable], .sheet p, .card p, #view .sub { -webkit-user-select: text; user-select: text; }
+
+/* "A new version is available" notice */
+#upd { position: fixed; left: 50%; transform: translateX(-50%); bottom: calc(var(--nav-h) + var(--sab) + 70px); z-index: 30; display: flex; align-items: center; gap: 12px;
+  background: var(--text); color: var(--bg); padding: 8px 8px 8px 16px; border-radius: 14px; box-shadow: 0 6px 24px rgba(0,0,0,.35); max-width: 92vw; }
+#upd .btn { min-height: 36px; background: var(--accent); color: var(--accent-t); }
+@media (min-width: 768px) { #upd { bottom: 24px; } }

public/sw.js

@@ -1,5 +1,5 @@
 // App-shell cache only; Seafile/API traffic always goes to the network.
-const CACHE = 'hub-v4';
+const CACHE = 'hub-v5';
 const SHELL = ['/style.css', '/app.js', '/icon.svg', '/manifest.webmanifest', '/icons/icon-192.png', '/icons/apple-touch-icon.png'];
 
 self.addEventListener('install', e => {