GET /api/v1/repos/:owner/:name/prompts carries an ETag and answers a repeat with 304 until a prompt source changes #9201

An owner steering the crew's briefs re-reads the prompt sources for free while none changed.

Done looks like:

• [x] The /api/v1/repos/:owner/:name/prompts route in src/http/api/prompts.ts answers 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.
• [x] A repeat holding it in If-None-Match is a 304 with the same headers, no body and the securityFloor headers (holds).
• [ ] The etag moves when a prompt source is added, edited or removed, or the repository's default branch moves a prompt file; two viewers who are shown different bodies never share an etag.
• [x] A token short of admin, a non-admin and a missing repository answer exactly as today, with no ETag, even with If-None-Match: *; the 304 is reached only after the access check.
• [ ] test/prompts-etag.test.ts covers each of the above and fails without the change.

Files: src/http/api/prompts.ts, test/prompts-etag.test.ts. Risks: do not touch src/http/api.ts; the body stays byte-for-byte as it is.

Reviewed pull #9221 at its head: ticked The /api/v1/repos/:owner/:name/prompts route in src/http/api/prompts.ts answers 200 with a weak etag from weakEtag (src/http/etag.ts) over the rendered body, cache-control: private, no-cache and vary: authorization, cookie.; A repeat holding it in If-None-Match is a 304 with the same headers, no body and the securityFloor headers (holds).; A token short of admin, a non-admin and a missing repository answer exactly as today, with no ETag, even with If-None-Match: *; the 304 is reached only after the access check.. left open: The etag moves when a prompt source is added, edited or removed, or the repository's default branch moves a prompt file; two viewers who are shown different bodies never share an etag. — Add, edit and remove move it, but a default-branch prompt-file move does not, because the body never reads the repository.; test/prompts-etag.test.ts covers each of the above and fails without the change. — The test does not cover the default-branch move or the two-viewers clause, so it does not cover each of box 3..

Left open after pull #9221 landed: 2 unticked items remain (The etag moves when a prompt source is added, edited or removed, or the repository's default branch moves a prompt file; two viewers who are shown different bodies never share an etag.; test/prompts-etag.test.ts covers each of the above and fails without the change.). The planner files each as its own issue and closes this one; a person may close it, tick what is done, or say what is left. Until then the crew does not pick it again.

Both open boxes go to #9241: the tests that show the etag moves with the prompt sources and is never shared between viewers.