UI files: ETag and revalidation on each load

The embedded UI was served without any cache header, so a browser or a
proxy could keep an old app.js after an update (seen with the API token
display). Each file now has an ETag (hash of its content, computed at
startup); the page, app.js and style.css are sent with "no-cache", so
each load costs a 304 without body until the next version. Fonts are
cached for 30 days.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

main.go

@@ -230,7 +230,7 @@ func main() {
 	go api.files.Run(ctx)
 	api.selfLog = selfLog
 	api.Routes(mux)
-	mux.Handle("GET /", http.FileServer(http.FS(static)))
+	mux.Handle("GET /", staticFiles(static))
 
 	app := readOnly(mux)
 	handler, err := newAuth(cfg.auth, app)