Always revalidate the app's files, tell open pages when a newer version exists, and log why a session is refused

An open page kept running the old version after a deploy (the single page never reloads), so the new
People screens did not appear. Static files are now sent with no-cache + ETag (304 when unchanged), icons
are cached for a week, /api/config reports a build stamp, and the app shows "A new version is available -
Reload" when it comes back into view or every 10 minutes. The service worker cache name is bumped.

The server also logs, at most once a minute per reason, why it refused a session cookie (unknown account,
turned off, signed out everywhere, bad signature, expired) without printing the cookie.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

public/app.js

@@ -1535,6 +1535,20 @@ function dirSheet(repo, path, name, dir) {
 // ---- Boot
 (async () => {
   try { cfg = { ...cfg, ...(await (await fetch('/api/config')).json()) }; } catch {}
+  const loadedBuild = cfg.build;
+  // When a new version is deployed, an open page keeps running the old one. Tell the person, and offer a reload.
+  const checkForUpdate = async () => {
+    try {
+      const c = await (await fetch('/api/config', { cache: 'no-store' })).json();
+      if (c.build && loadedBuild && c.build !== loadedBuild && !document.getElementById('upd')) {
+        const b = document.createElement('div'); b.id = 'upd';
+        b.innerHTML = 'A new version of NE Hub is available. <button class="btn" id="updgo">Reload</button>';
+        document.body.appendChild(b); document.getElementById('updgo').onclick = () => location.reload();
+      }
+    } catch {}
+  };
+  document.addEventListener('visibilitychange', () => { if (document.visibilityState === 'visible') checkForUpdate(); });
+  setInterval(checkForUpdate, 10 * 60e3);
   await loadMe();
   await loadSettings();
   addEventListener('hashchange', route);