site: never let browsers serve stale HTML

HTML shipped with stale-while-revalidate=3600, so after a deploy a
visitor's browser could keep showing hour-old copies of pages they
had already opened while fresh pages loaded the new design — two
site versions in one session. All HTML responses are now no-cache
(assets keep long-lived content-hash caching), and the site test
asserts the header on every page.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: gitcommit90

site/server.mjs

@@ -314,7 +314,7 @@ const server = createServer(async (req, res) => {
   if (STATIC_PAGES[path]) {
     answer(res, 200, STATIC_PAGES[path], {
       "content-type": "text/html; charset=utf-8",
-      "cache-control": "public, max-age=300, stale-while-revalidate=3600",
+      "cache-control": "no-cache",
     });
     return;
   }
@@ -366,7 +366,7 @@ const server = createServer(async (req, res) => {
   if (page) {
     answer(res, 200, renderPage({ ...page, path, version: VERSION, assetVersion: SITE_ASSET_VERSION }), {
       "content-type": "text/html; charset=utf-8",
-      "cache-control": "public, max-age=300, stale-while-revalidate=3600",
+      "cache-control": "no-cache",
     });
     return;
   }

test/site.mjs

@@ -35,6 +35,7 @@ test("standalone 1helm.com website serves independent product and documentation
     for (const path of ["/manual", "/terms", "/privacy", "/manual/getting-started", "/manual/architecture", "/manual/outcome-ownership", "/manual/skills", "/manual/verification", "/manual/providers", "/manual/channel-computers", "/manual/connections", "/manual/install-macos", "/manual/install-linux", "/manual/install-windows", "/manual/self-hosting", "/manual/security-model"]) {
       const response = await fetch(base + path); assert.equal(response.status, 200, path);
       assert.match(response.headers.get("content-security-policy") || "", /default-src 'self'/);
+      assert.equal(response.headers.get("cache-control"), "no-cache", `${path} must never be browser-cached`);
     }
     const gettingStarted = await (await fetch(`${base}/manual/getting-started`)).text();
     assert.match(gettingStarted, /On Windows 11 x64, download the signed Setup executable/i);