broker: API GET answers carry Cache-Control: no-store

The broker sent /statistics and the other API answers with no caching headers, so Firefox kept them
in its HTTP cache. A page restored from Firefox's session read the cached /statistics before asking
the broker, and the web frontend's spot-finding panel adopted settings the broker had since replaced
- after a broker restart, the ones that browser last saw rather than the configuration file's.
API GET answers are now marked no-store; the static frontend under /frontend stays cacheable.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UqXYdL4qBGYRiSXSGXfCLu

broker/JFJochBrokerHttp.cpp

@@ -197,6 +197,13 @@ void JFJochBrokerHttp::attach(httplib::Server &server) {
         return httplib::Server::HandlerResponse::Unhandled;
     });
 
+    // API answers describe the broker's state now; a browser must not keep them. Without this Firefox
+    // cached /statistics, and a page restored from its session adopted settings long since replaced.
+    server.set_post_routing_handler([](const httplib::Request &req, httplib::Response &res) {
+        if (req.method == "GET" && !req.path.starts_with("/frontend"))
+            res.set_header("Cache-Control", "no-store");
+    });
+
     // Last resort for an exception that got past a route's own handler - httplib would otherwise
     // answer with a bodyless 500, which no generated client can deserialize into an error_message.
     server.set_exception_handler([this](const httplib::Request &, httplib::Response &res,