GET /api/v1/version carries an ETag and answers a repeat with 304; a harness probing it on every connect pays a header #9251

Gitea-shaped clients and the forge plugins call /api/v1/version on every connect. Its body changes only when FORGE_API_VERSION does, so a repeat should be a 304.

Done looks like:

• [x] The /api/v1/version route in src/http/api/forge_origin.ts answers 200 with a weak etag from weakEtag (src/http/etag.ts) over the body and cache-control: no-cache. It sends no vary on credentials, because the body is the same for everyone.
• [x] A repeat holding the tag in If-None-Match (or *) is a 304 with the same headers, no body, and the securityFloor headers (holds).
• [x] The tag is derived from the body, so changing FORGE_API_VERSION changes it. A test shows this by computing the expected tag from the body rather than hard-coding it.
• [x] test/version-etag.test.ts covers the 200, the 304, a signed-in and an anonymous caller getting the same tag, and a stale tag getting a 200. Each case fails without the change.

Files: src/http/api/forge_origin.ts, test/version-etag.test.ts. Risks: do not touch src/http/api.ts. The body stays byte-for-byte {version, software}.

Reviewed pull #9257 at its head: ticked The /api/v1/version route in src/http/api/forge_origin.ts answers 200 with a weak etag from weakEtag (src/http/etag.ts) over the body and cache-control: no-cache. It sends no vary on credentials, because the body is the same for everyone.; A repeat holding the tag in If-None-Match (or *) is a 304 with the same headers, no body, and the securityFloor headers (holds).; The tag is derived from the body, so changing FORGE_API_VERSION changes it. A test shows this by computing the expected tag from the body rather than hard-coding it.; test/version-etag.test.ts covers the 200, the 304, a signed-in and an anonymous caller getting the same tag, and a stale tag getting a 200. Each case fails without the change..