[pitill0]

Summary

Closes #312.

Activate content-addressed Web static assets in the repository's Compose deployment and harden the existing publication and HTTP delivery mechanisms.

Changes

• Enable versioned static assets explicitly in compose.yaml, backed by persistent storage.
• Ensure legacy CSS uses Cache-Control: no-cache.
• Align HEAD and GET representation headers for versioned gzip assets.
• Remove the obsolete favicon declaration.
• Clean up stale temporary snapshot directories under the publication lock.
• Improve diagnostics for corrupted snapshots without automatically deleting published data.
• Update Web deployment documentation and the changelog.
• Add regression coverage for caching, deployment configuration, snapshot lifecycle and symlink substitution.

Validation

• Full pytest suite: 1,887 passed, 8 skipped.
• Ruff lint and formatting: passed.
• Mypy: passed.
• JavaScript syntax: passed.
• Bandit: no findings.
• Fresh isolated Web dependency installation: pip check passed; pip-audit reported no known vulnerabilities.

The historical local development environment contains outdated dependencies and has separate pip-audit findings. Production deployment and CI dependency validation remain separate checks.

Deployment notes

Versioned static assets are opt-in outside the repository's Compose configuration. Deployments require persistent, writable storage under FLUXTUNER_DATA_DIR/web/static-builds/.

No changes have been applied to the existing Lokalix deployment.