No signed-in page or API answer can be stored by a shared cache, and immutable assets are cached for a year: a test checks both

A shared cache keeping a signed-in page would show one person's forge to another.

Done when:

[ ] A test requests a set of signed-in HTML pages (/, a private repository, /asked, /forges) and API answers (/api/v1/feed, a private issue). Each must carry Cache-Control with private or no-store, and none public or s-maxage.
[ ] Content-addressed assets (the toolbar script, the stylesheet) answer public, max-age=31536000, immutable.
[ ] Signed-out public pages may stay cacheable. The test lists which ones and why.
[ ] Any answer found wrong is fixed in the same pull.

No signed-in page or API answer can be stored by a shared cache, and immutable assets are cached for a year: a test checks both #5899