Add cache-busting version query to static assets

Cloudflare was caching /static/style.css and /static/app.js at the
edge for up to 4 hours (its default Browser Cache TTL, since the app
sets no explicit Cache-Control), so deploys could look like they
hadn't landed even though the origin was already up to date. A
content hash of style.css/app.js/htmx.min.js, computed once at
startup, is now appended as ?v=<hash> to their URLs in base.html, so
every deploy that changes those files produces new, never-cached
URLs and needs no manual cache purge.

Also commits the live-sync-updates design spec, which was written
but never staged earlier in the session.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

tests/web/test_static_cache_busting.py

@@ -0,0 +1,12 @@
+import re
+
+from fastapi.testclient import TestClient
+
+
+def test_static_assets_are_served_with_a_cache_busting_version(client: TestClient) -> None:
+    response = client.get("/login")
+
+    assert response.status_code == 200
+    assert re.search(r'/static/style\.css\?v=[0-9a-f]{6,}"', response.text)
+    assert re.search(r'/static/app\.js\?v=[0-9a-f]{6,}"', response.text)
+    assert re.search(r'/static/htmx\.min\.js\?v=[0-9a-f]{6,}"', response.text)