Static serving: correct cache headers, no index fallback for assets

- /assets/*: immutable one-year cache on hits, plain 404 on misses
  (previously a missing asset fell back to index.html served as its
  content type, breaking CSS/JS after every deploy for cached clients)
- index.html and SPA routes: no-cache, so deploys are visible immediately

Cargo.toml

@@ -37,7 +37,8 @@ tempfile = "3"
 time = "0.3"
 tokio = { version = "1", features = ["full"] }
 tokio-util = { version = "0.7", features = ["io"] }
-tower-http = { version = "0.6", features = ["fs", "trace"] }
+tower = { version = "0.5", features = ["util"] }
+tower-http = { version = "0.6", features = ["fs", "set-header", "trace"] }
 tracing = "0.1"
 tracing-subscriber = { version = "0.3", features = ["env-filter"] }
 urlencoding = "2"