- web/public/_headers: /assets/* → public, max-age=31556952, immutable (Vite content-hashed output)
- / → public, max-age=0, must-revalidate (the HTML entry points at the current hashed assets)
- no CORS/Set-Cookie/other rules — same-origin policy stays the app's design
- verified: web/dist/_headers exists after the theme+web build