perf(web): let browsers cache public assets for an hour

Live sends no Cache-Control on its assets, so browsers kept them by
heuristic for months. Node sent max-age=0, which made every page view
revalidate every stylesheet, script and image. An hour removes those
round trips within a visit; asset names are not fingerprinted, so a
deploy still reaches browsers within the hour.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: kckern

apps/web/src/app/middleware/static.js

@@ -11,8 +11,11 @@ function setHeaders(res, filePath) {
   if (path.extname(filePath).toLowerCase() === '.ico') res.setHeader('Content-Type', 'image/vnd.microsoft.icon');
 }
 
+// An hour of browser caching: live sent no Cache-Control and browsers kept its assets by
+// heuristic, while max-age=0 revalidated every asset on every page. Names are not fingerprinted,
+// so a deploy reaches browsers within the hour.
 export function publicStatic(dir = PUBLIC_DIR) {
-  return express.static(dir, { setHeaders });
+  return express.static(dir, { setHeaders, maxAge: '1h' });
 }
 
 // FONT_DIR (licensed fonts that must not be published) at /private-fonts; no route when unset.

apps/web/test/unit/staticServe.test.js

@@ -19,6 +19,12 @@ describe('public static files', () => {
     expect(res.headers['content-type']).toBe('image/vnd.microsoft.icon');
     expect(Buffer.compare(res.body, readFileSync(new URL('../../public/favicon.ico', import.meta.url)))).toBe(0);
   });
+  it('lets browsers keep assets for an hour instead of revalidating on every page', async () => {
+    // Live sends no Cache-Control, so browsers kept its year-old assets by heuristic; max-age=0
+    // made every page view revalidate each asset
+    const res = await request(app).get('/css/style.css');
+    expect(res.headers['cache-control']).toBe('public, max-age=3600');
+  });
   it('leaves other types alone', async () => {
     const res = await request(app).get('/js/main.js');
     expect(res.status).toBe(200);