caddy: force no-cache on service worker scripts
sw.js was being served with max-age=3600, so browsers wouldn't even
check for an updated SW for up to an hour. That defeats CACHE_NAME
bumps — clients stayed pinned to the old worker (and its stale module
cache) until the HTTP cache expired. Service workers should always
revalidate.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>