fix(pwa): BUG-005 chargement mobile via Cloudflare (SW network-first + no-cache)

tests/test_api_main.py

@@ -719,4 +719,38 @@ class TestSecretRedactor:
     def test_redact_plain_text(self):
         from backend.secret_redactor import redact_file_content
         result = redact_file_content("hello world this is safe")
-        assert result == "hello world this is safe"
+        assert result == "hello world this is safe"
+
+
+# ═══════════════════════════════════════════════════════════════════
+# Static / PWA caching (Cloudflare / mobile freshness)
+# ═══════════════════════════════════════════════════════════════════
+
+
+class TestStaticCaching:
+    """Unhashed assets must revalidate (``no-cache``) to avoid stale builds.
+
+    This is the server-side half of the fix for mobile loads behind
+    Cloudflare: without ``Cache-Control`` the edge/browser could serve an old
+    build indefinitely.
+    """
+
+    def test_spa_index_revalidates(self, client):
+        resp = client.get("/")
+        assert resp.status_code == 200
+        assert "no-cache" in resp.headers.get("cache-control", "")
+
+    def test_service_worker_revalidates(self, client):
+        resp = client.get("/sw.js")
+        assert resp.status_code == 200
+        assert "no-cache" in resp.headers.get("cache-control", "")
+
+    def test_manifest_revalidates(self, client):
+        resp = client.get("/manifest.json")
+        assert resp.status_code == 200
+        assert "no-cache" in resp.headers.get("cache-control", "")
+
+    def test_static_asset_revalidates(self, client):
+        resp = client.get("/static/style.css")
+        assert resp.status_code == 200
+        assert "no-cache" in resp.headers.get("cache-control", "")