R65 A1-A6：Session 稳定性与 409 资源错误修复

server/src/app.js

@@ -78,6 +78,27 @@ const { initMetrics } = require("./observability");
 const { AppError } = require("./utils/AppError");
 const { buildDataEnvelopeSchema, buildErrorEnvelopeSchema } = require("./utils/openapi");
 
+const NO_CACHE_STATIC_FILES = new Set([
+  "index.html",
+  "sw.js",
+  "manifest.webmanifest",
+  "registerSW.js",
+]);
+
+function setStaticCacheHeaders(res, filePath) {
+  const normalizedPath = String(filePath).replace(/\\/g, "/");
+  const fileName = normalizedPath.split("/").pop() ?? "";
+
+  if (NO_CACHE_STATIC_FILES.has(fileName)) {
+    res.setHeader("Cache-Control", "no-cache, no-store, must-revalidate");
+    return;
+  }
+
+  if (normalizedPath.includes("/assets/") || /\/workbox-[^/]+\.js$/i.test(normalizedPath)) {
+    res.setHeader("Cache-Control", "public, max-age=31536000, immutable");
+  }
+}
+
 async function buildApp() {
   const config = getConfig();
 
@@ -151,7 +172,9 @@ async function buildApp() {
 
   if (config.serveClientDist) {
     await app.register(staticPlugin, {
+      cacheControl: false,
       root: config.clientDistDir,
+      setHeaders: setStaticCacheHeaders,
     });
     app.log.info({ dir: config.clientDistDir }, "Client dist static serving enabled");
   }
@@ -172,6 +195,7 @@ async function buildApp() {
       request.headers.accept.includes("text/html") &&
       typeof reply.sendFile === "function"
     ) {
+      reply.header("Cache-Control", "no-cache, no-store, must-revalidate");
       return reply.type("text/html").sendFile("index.html");
     }