fix(icons): serve icons no-cache so updates propagate (2.5.2)

Icon route used Cache-Control: public, max-age=86400, so changed icons stayed
stuck in CF + browser caches for a day. Switch to no-cache (revalidate; Express
ETag => 304 when unchanged) so icon edits show up immediately.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lib/api/routes/icon_sets.js

@@ -20,7 +20,10 @@ router.get('/:set/:file', asyncWrap(async (req, res) => {
   try { buf = await sets.readIcon(req.params.set, req.params.file); }
   catch (e) { return res.status(e.message === 'bad_slug' ? 400 : 404).end(); }
   const ct = req.params.file.endsWith('.svg') ? 'image/svg+xml' : 'image/png';
-  res.set('Content-Type', ct).set('Cache-Control', 'public, max-age=86400').send(buf);
+  // no-cache => browsers/CF revalidate (304 via Express's ETag when unchanged), so
+  // icon updates propagate immediately instead of being stuck for a day. Icons are
+  // tiny, so the revalidation cost is negligible.
+  res.set('Content-Type', ct).set('Cache-Control', 'no-cache').send(buf);
 }));
 
 // POST /api/icon-sets/:set — owner upload: multipart files (incl .zip) and/or { url }.

package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "void-server",
-  "version": "2.5.1",
+  "version": "2.5.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "void-server",
-      "version": "2.5.1",
+      "version": "2.5.2",
       "dependencies": {
         "@modelcontextprotocol/sdk": "^1.29.0",
         "@mozilla/readability": "^0.6.0",

package.json

@@ -1,6 +1,6 @@
 {
   "name": "void-server",
-  "version": "2.5.1",
+  "version": "2.5.2",
   "type": "module",
   "private": true,
   "scripts": {

server.js

@@ -15,7 +15,7 @@ import { mcpAuth } from './lib/api/middleware/mcp_auth.js';
 import { handleMcp } from './lib/mcp/http.js';
 import httpProxy from 'http-proxy';
 
-const VERSION = '2.5.1';
+const VERSION = '2.5.2';
 
 // Proxy /terminal (+ its WebSocket) to ttyd on CT 300, so the embedded terminal
 // works whether the Void is reached via Traefik (void2-app.hynesy.com) OR the