Optimize page loads and stabilize diagnostics charts - #191

Summary

• add a dedicated static-delivery policy that applies deterministic gzip only to public CSS, JavaScript, and SVG assets, removes artificial cookie variance, and gives content-addressed assets immutable caching
• generate a six-locale authentication-only translation bundle with a stale-output CI guard instead of loading the full workspace catalog on sign-in pages
• defer decorative authentication backgrounds until after the load event and derive direct template/CSS asset versions from SHA-256 content hashes
• keep diagnostics canvas dimensions stable when switching between Workspaces and other primary views

Safety boundaries

• dynamic HTML, API/JSON responses, ranges, binary assets, HEAD bodies, and non-GET/HEAD cache paths are never compressed or marked immutable
• static responses that mutate an authentication cookie are forced to private, no-store
• gzip and identity representations use distinct ETags, while CSP and the existing security headers remain intact
• gzip-aware HEAD responses expose the same encoding, length, validator, variance, and cache policy as equivalent GET responses while retaining an empty body
• static conditional validators are evaluated after content-encoding negotiation, so an identity ETag cannot validate an unacceptable gzip-only request
• cache policy is classified from the final post-precondition status, keeping failures such as 412 out of shared caches
• the server grants immutable caching only when the URL hash matches the current file content; malformed, mismatched, ambiguous, and missing query URLs are no-store, while clean unversioned URLs must revalidate
• hidden diagnostics canvases are not redrawn from their device-pixel backing dimensions; CSS retains control of logical sizing and charts redraw after Workspaces becomes visible again
• no runtime dependency or lock-file changes are required

Performance evidence

Measured against 615ede3 with Chromium, cold browser cache, 5 Mbit/s throughput, 80 ms latency, and seven alternating runs:

Five alternating warm-cache runs reduced median login load from 273 ms to 116 ms (-57.6%) and transferred bytes from 20,609 B to 11,877 B (-42.4%). The authentication translation bundle is 76,308 B instead of 521,884 B (-85.4% raw).

Testing

• pytest -q: 2,352 passed, 29 skipped
• static delivery regression suite: 13 passed, including gzip GET/HEAD metadata parity
• JavaScript unit suite: 38 passed
• Playwright E2E shards: 104 passed
• complete session workspace browser suite: 16 passed, including four repeated Diagnostics/File Manager navigation cycles
• post-hardening auth/load, layout, and theme browser regression: 14 passed
• authentication bundle freshness check, ESLint, vendored asset verification, and git diff --check

Fixes #192