fix(pwa): enable Workbox precaching and add Caddy cache-control headers

Author: Just-Insane

.changeset/fix-media-error-handling.md

@@ -0,0 +1,5 @@
+---
+default: patch
+---
+
+Fix intermittent 401 errors when loading media after service worker restart. Service worker now expires cached authentication tokens after 60 seconds, forcing fresh token retrieval from the active page instead of using potentially stale persisted tokens.

Caddyfile

@@ -16,6 +16,13 @@
 
 	try_files {path} /index.html
 
+	# Content-hashed assets can be cached indefinitely — the filename changes on every build.
+	header /assets/* Cache-Control "public, max-age=31536000, immutable"
+	# Workbox SW must be revalidated on every load so the browser picks up updates.
+	header /sw.js Cache-Control "no-cache"
+	# index.html must not be cached so the browser always gets the latest app shell.
+	header /index.html Cache-Control "no-cache"
+
         # Required for Sentry browser profiling (JS Self-Profiling API)
         header Document-Policy "js-profiling"
 }

vite.config.ts

@@ -176,7 +176,11 @@ export default defineConfig(({ command }) => ({
       injectRegister: false,
       manifest: false,
       injectManifest: {
-        injectionPoint: undefined,
+        // element-call is a self-contained embedded app; exclude its large assets
+        // from the SW precache manifest (they are not part of the Sable shell).
+        globIgnores: ['public/element-call/**'],
+        // The app's own crypto WASM and main bundle exceed the 2 MiB default.
+        maximumFileSizeToCacheInBytes: 10 * 1024 * 1024, // 10 MiB
       },
       devOptions: {
         enabled: true,