fix: kill zombie pre-rewrite service worker

The old service-worker.js (repo root, removed when web/ was rewritten)
cached every same-origin GET keyed only by frontend PACKAGE_VERSION, so
a backend-only change never invalidated it. Browsers that had visited
this origin before the rewrite kept getting stale cached API responses
(bootstrap/session calls) served instead of hitting the real backend --
looked like "login succeeds then immediately bounces back to login".

Adds a same-path kill-switch service-worker.js that purges all caches
and unregisters itself, plus an explicit update() check on app boot so
already-registered browsers don't have to wait for the browser's own
lazy update schedule.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/public/service-worker.js

@@ -0,0 +1,24 @@
+// Kill switch for the pre-rewrite service worker (formerly at repo root, see git history).
+// That worker cached every same-origin GET (including session/bootstrap API calls) keyed only
+// by frontend PACKAGE_VERSION -- a backend-only change (deploy, migration, cutover) never
+// invalidated it, so browsers that had visited this origin before the rewrite kept getting
+// stale API responses served instead of hitting the new backend, which looked like "login
+// succeeds then immediately bounces back to the login page".
+//
+// This file's only job is to replace that worker in already-registered browsers and remove
+// it entirely: purge its caches, unregister, then reload any open tabs so they load uncontrolled.
+// The rewritten app (web/) does not use a service worker for anything -- do not add fetch
+// caching logic here.
+self.addEventListener('install', () => self.skipWaiting());
+
+self.addEventListener('activate', event => {
+  event.waitUntil((async () => {
+    const keys = await caches.keys();
+    await Promise.all(keys.map(key => caches.delete(key)));
+    await self.registration.unregister();
+    const clientsList = await self.clients.matchAll({ type: 'window' });
+    for (const client of clientsList) {
+      client.navigate(client.url);
+    }
+  })());
+});