fix(dashboard): revalidate HTML app shell so obsidian card shows /obsidian/ not :3000

[AlienWalker1995]

What the operator saw

The new obsidian row in the dashboard Services tab showed a raw :3000 instead of the clean /obsidian/ SSO link.

Discriminating evidence — it was NOT #78, it was browser cache

Live /api/services obsidian entry (container-to-container via caddy + X-Forwarded-Email) is structurally identical to codebase-memory-ui — the working precedent:

obsidian: { id, name:"Obsidian", port:3000, has_gpu:false, hint, ok:true, error:null }

• No url key and the check URL is NOT echoed into the payload.
• serviceOpenHref therefore takes the APP_PREFIX && SSO_ROUTES['obsidian'] branch → location.origin + '/obsidian/'.
• The card renders only: name, the SSO Open link, Running/Offline, and (only when offline) a hint that says https://<host>/obsidian/ — :3000 appears nowhere.

So current code cannot produce :3000. The served index.html from #78 already contains obsidian: '/obsidian/' in SSO_ROUTES. The operator's browser was serving a cached pre-#78 shell (dashboard recreated ~21:25Z; the old shell had a url/no-obsidian-route and fell through to serviceUrl(host, s.port) → :3000).

Root cause (upstream, recurring — not a one-off)

Starlette's StaticFiles sends ETag + Last-Modified but no Cache-Control on index.html. Browsers then apply heuristic freshness and serve the stale app shell without revalidating. Every future dashboard rebuild (new SSO routes / service cards) risks the same stale-shell drift. Telling the operator to hard-refresh would be a per-incident bandaid that repeats forever.

Fix

Subclass StaticFiles to add Cache-Control: no-cache to HTML responses only. The shell stays cached but MUST revalidate its ETag every load, so new builds are picked up immediately; hashed static assets keep their long-cache behavior.

Tests (root tests/test_services_and_throughput.py)

• test_index_html_sends_no_cache — HTML shell returns Cache-Control: no-cache and still carries an ETag.
• test_obsidian_entry_is_sso_routed_like_codebase_memory — locks the obsidian entry to the SSO-routed shape (no url, port for the probe only, hint uses /obsidian/, never :3000), mirroring codebase-memory-ui.

Acceptance (validated live on ordo-v2, only dashboard rebuilt/recreated)

• Served shell now carries cache-control: no-cache (ETag retained) + the obsidian: '/obsidian/' route.
• /api/services obsidian entry clean; render branch → /obsidian/, no :3000 in any visible field.
• /api/hardware still returns disk (1999.8 GB total) + both GPUs (GTX 1070 + RTX 5090) — env overrides persist via the manifest.
• Dashboard healthy; obsidian / llamacpp / agent container IDs unchanged (only dashboard recreated).
• Root ruff (dashboard/) clean; 118 passed, 4 skipped.

🤖 Generated with Claude Code