[CLAUDE] FE-User · FE-Admin: web.config — index.html no-cache + assets immutable

S88 white-screen-incident hardening. An open tab could serve a stale index.html across
a deploy (IIS served index.html cacheable: only ETag/Last-Modified, no Cache-Control).
Add version-controlled web.config to fe-*/public (Vite -> dist -> deploy Copy-Item
overwrites the previously manually-managed server file):
- root staticContent clientCache=DisableCache -> Cache-Control: no-cache for the SPA
  shell (index.html served at / and via SPA-rewrite for /dashboard etc.) = always revalidate.
- <location path="assets"> UseMaxAge 365d + custom immutable -> hashed assets cached 1y.
Replicates the EXACT live rules (HTTP->HTTPS, SPA-Routes rewrite excl /api, .webmanifest
mime, 3 security headers) so routing is preserved. Applied + verified on live before commit
(index.html no-cache; asset immutable,max-age; / /dashboard /login 200; http->https 301).
api = .NET API (no SPA index.html) -> N/A.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

fe-user/public/web.config

@@ -0,0 +1,48 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<configuration>
+  <system.webServer>
+    <rewrite>
+      <rules>
+        <rule name="HTTP to HTTPS" stopProcessing="true">
+          <match url="(.*)" />
+          <conditions>
+            <add input="{HTTPS}" pattern="^OFF$" />
+          </conditions>
+          <action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="Permanent" />
+        </rule>
+        <rule name="SPA Routes" stopProcessing="true">
+          <match url=".*" />
+          <conditions logicalGrouping="MatchAll">
+            <add input="{REQUEST_FILENAME}" matchType="IsFile" negate="true" />
+            <add input="{REQUEST_FILENAME}" matchType="IsDirectory" negate="true" />
+            <add input="{REQUEST_URI}" pattern="^/api" negate="true" />
+          </conditions>
+          <action type="Rewrite" url="/" />
+        </rule>
+      </rules>
+    </rewrite>
+    <staticContent>
+      <remove fileExtension=".webmanifest" />
+      <mimeMap fileExtension=".webmanifest" mimeType="application/manifest+json" />
+      <!-- [S88 hardening] SPA shell (index.html, served at / and via SPA-rewrite for /dashboard
+           etc.) + root static = no-cache so an open tab never serves a stale shell across a
+           deploy (the white-screen incident). Hashed /assets are overridden to immutable below. -->
+      <clientCache cacheControlMode="DisableCache" />
+    </staticContent>
+    <httpProtocol>
+      <customHeaders>
+        <add name="X-Content-Type-Options" value="nosniff" />
+        <add name="X-Frame-Options" value="DENY" />
+        <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
+      </customHeaders>
+    </httpProtocol>
+  </system.webServer>
+  <!-- [S88 hardening] Content-hashed build assets (index-<hash>.js/.css) are immutable -> cache 1y. -->
+  <location path="assets">
+    <system.webServer>
+      <staticContent>
+        <clientCache cacheControlMode="UseMaxAge" cacheControlMaxAge="365.00:00:00" cacheControlCustom="public, immutable" />
+      </staticContent>
+    </system.webServer>
+  </location>
+</configuration>