Cache headers end the stale-bundle era; finished games rest their buttons

The static server sent no Cache-Control at all, so browsers
heuristically cached index.html — and a stale index.html pins its
user to last deploy's hashed assets no matter how often they reload.
That is how "watch the whole game" could show someone an app without
the feature minutes after it shipped. Hashed assets now cache forever
(immutable); everything else revalidates.

And per playtesting: a finished game offers no actions — isYourTurn
now requires the playing phase, which retires the pick-up/drop/punch/
discard/end-turn row the moment the trophy drops.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/server/src/index.ts

@@ -111,7 +111,15 @@ const httpServer = createServer((req, res) => {
       return;
     }
     const body = readFileSync(real);
-    res.writeHead(200, { "content-type": MIME[extname(real)] ?? "application/octet-stream" });
+    // Hashed assets may cache forever; everything else must revalidate, or a
+    // stale index.html pins users to a dead bundle across deploys.
+    const cache = real.includes(`${sep}assets${sep}`)
+      ? "public, max-age=31536000, immutable"
+      : "no-cache";
+    res.writeHead(200, {
+      "content-type": MIME[extname(real)] ?? "application/octet-stream",
+      "cache-control": cache,
+    });
     res.end(body);
   } catch {
     res.writeHead(500).end();