fix: force cache-busting headers and script tag to prevent stale app.js browser cache