fix: kill zombie pre-rewrite service worker

The old service-worker.js (repo root, removed when web/ was rewritten)
cached every same-origin GET keyed only by frontend PACKAGE_VERSION, so
a backend-only change never invalidated it. Browsers that had visited
this origin before the rewrite kept getting stale cached API responses
(bootstrap/session calls) served instead of hitting the real backend --
looked like "login succeeds then immediately bounces back to login".

Adds a same-path kill-switch service-worker.js that purges all caches
and unregisters itself, plus an explicit update() check on app boot so
already-registered browsers don't have to wait for the browser's own
lazy update schedule.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

web/src/main.tsx

@@ -3,6 +3,16 @@ import { createRoot } from 'react-dom/client'
 import './index.css'
 import App from './App.tsx'
 
+// This app has no service worker of its own, but browsers that visited this origin before the
+// redesign/desktop-multicolumn rewrite may still have the old one registered (see
+// public/service-worker.js) -- force an immediate update check rather than waiting for the
+// browser's own lazy schedule, so it gets replaced by the kill switch right away.
+if ('serviceWorker' in navigator) {
+  navigator.serviceWorker.getRegistrations().then(regs => {
+    regs.forEach(reg => reg.update())
+  })
+}
+
 createRoot(document.getElementById('root')!).render(
   <StrictMode>
     <App />