Revert "config.js: cache-bust via ?v=<commit> in index.html script tag"

This reverts commit 3ea9c71.

Author: hans-crypto

frontend/angular.json

@@ -173,6 +173,7 @@
               "src/customize.js",
               "src/config.template.js",
               "src/_redirects",
+              "src/_headers",
               {
                 "glob": "*.css",
                 "input": ".theme-build",
@@ -198,7 +199,8 @@
               "assets": [
                 "src/favicon.ico",
                 "src/robots.txt",
-                "src/_redirects"
+                "src/_redirects",
+                "src/_headers"
               ],
               "fileReplacements": [
                 {

frontend/generate-config.js

@@ -96,27 +96,6 @@ if (process.env.DOCKER_COMMIT_HASH) {
   }
 }
 
-// HACK -- Ordpool: cache-bust config.js / customize.js by appending
-// `?v=<gitCommitHash>` to their <script src> in index.html. These files
-// aren't fingerprinted (Angular only hashes its own bundles), so without
-// the query suffix the browser keeps reading the previous build's
-// window.__env until /resources/config.js's max-age expires. Same trick
-// Angular uses for its bundle filenames -- different URL per deploy
-// forces a fresh fetch; matching ETag still 304's when content is
-// unchanged.
-try {
-  const stamp = gitCommitHash || Date.now().toString(36);
-  let indexHtml = fs.readFileSync('src/index.html', 'utf-8');
-  indexHtml = indexHtml.replace(
-    /<script\s+src="\/resources\/(config|customize)\.js(?:\?[^"]*)?"><\/script>/g,
-    `<script src="/resources/$1.js?v=${stamp}"></script>`,
-  );
-  fs.writeFileSync('src/index.html', indexHtml);
-  console.log(`Cache-busted /resources/{config,customize}.js in src/index.html with v=${stamp}`);
-} catch (e) {
-  console.log('Warning: could not cache-bust resources/config.js in index.html:', e.message);
-}
-
 const newConfig = `(function (window) {
   window.__env = window.__env || {};${settings.reduce((str, obj) => `${str}
     window.__env.${obj.key} = ${typeof obj.value === 'string' ? `'${obj.value}'` : obj.value};`, '')}

frontend/src/_headers

@@ -0,0 +1,13 @@
+# Cloudflare Pages _headers — Cache-Control overrides for files that
+# change on every deploy but aren't fingerprinted in the URL. Wired into
+# the build via angular.json (assets) and shipped in dist/.
+#
+# Without this, Pages defaults to a multi-hour TTL on .js files, so
+# already-open tabs keep reading the previous build's window.__env
+# (GIT_COMMIT_HASH, BASE_MODULE, etc.) until their cache expires. ETag
+# revalidation closes the gap to one 304 round-trip per page load.
+/resources/config.js
+  Cache-Control: public, max-age=0, must-revalidate
+
+/resources/customize.js
+  Cache-Control: public, max-age=0, must-revalidate