/changelog answers a repeat visit with 304: an ETag for every reader, not no-cache #11023

Production's /changelog answers anonymous readers with cache-control: no-cache and no ETag (checked 2026-11-10), so every visit re-renders and re-sends the page, while src/web/pages/changelog.ts already builds a changelogTag for one branch.

Done when:

• [x] GET /changelog, anonymous and signed in, carries an ETag built from what the page shows (release version, the rows, the filter in the query, and the reader's role where it changes the page).
• [x] A repeat GET with If-None-Match answers 304 with no body and the security floor headers.
• [x] Anonymous answers are public, max-age=0, s-maxage=60, stale-while-revalidate=300 like / and /explore; signed-in answers are private.
• [x] test/changelog-cache.test.ts proves: the tag changes when a release lands, a filtered page has its own tag, 304 on a match, and a signed-in page is never public.

Files: src/web/pages/changelog.ts, test/changelog-cache.test.ts (new). Risk: a public cache must never hold a signed-in page; test that first.

Reviewed pull #11027 at its head: ticked GET /changelog, anonymous and signed in, carries an ETag built from what the page shows (release version, the rows, the filter in the query, and the reader's role where it changes the page).; A repeat GET with If-None-Match answers 304 with no body and the security floor headers.; Anonymous answers are public, max-age=0, s-maxage=60, stale-while-revalidate=300 like / and /explore; signed-in answers are private.; test/changelog-cache.test.ts proves: the tag changes when a release lands, a filtered page has its own tag, 304 on a match, and a signed-in page is never public..