web: give the embedded static assets a content ETag

The assets are baked into the binary, so their FS modification times are the
zero value and http.FileServer sent no Last-Modified. With no ETag either, a
static response carried no validator at all and the browser was free to guess
how long to keep it -- which is how the panel kept showing the previous favicon
in the tab well after the new mark was deployed.

Hash each asset once at startup and serve that as a strong ETag, with
Cache-Control: no-cache so the browser keeps its copy but revalidates. An
unchanged asset then costs a bodyless 304 and a changed one is picked up on the
next load.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

internal/web/web.go

@@ -147,8 +147,9 @@ func (s *Server) Handler() http.Handler {
 	// Health check stays unauthenticated for the container/orchestrator.
 	mux.HandleFunc("/healthz", handleHealth)
 
-	// Vendored static assets (HTMX). Served from the embedded FS.
-	mux.Handle("/static/", http.FileServer(http.FS(assetsFS)))
+	// Vendored static assets (HTMX). Served from the embedded FS, with a
+	// content ETag so a replaced asset survives the browser cache (static.go).
+	mux.Handle("/static/", staticHandler())
 
 	// One-time administrator setup (security.md).
 	mux.HandleFunc("/setup/", s.handleSetup)