fix(web): signed-in pages say Cache-Control: private, no-store (closes #158) 33bd0bd45f8a

- **Diffusion (#148, docs/diffusion.md).** When a repository that others pin as a subrepo moves on, each consumer that follows it gets a proposal moving the pin, signed by the hub, tested by the consumer's own pipeline, with the upstream's changes listed. One proposal per consumer and subrepo, kept up to date; never landed by itself. Turned on per repository (Settings › Diffusion, `PUT /repos/{owner}/{name}/diffusion`, or `follow` in `.oxymodules`), off by default; `green` waits for the upstream's run to pass. A repository's page shows who uses it and how far behind each is (Diffusion › Diffuses to, `GET /repos/{owner}/{name}/consumers`). Consumers are bumped on the bookmark their work lands on, learned from where their proposals land.

- **Diffusion in the API (#153):** `GET /repos/{owner}/{name}/diffusion` gives what a repository takes from and what it diffuses to, each with its pill, for the VS Code extension.

- **The dashboard in cards (#155):** each section a rounded card with its heading and count in a shaded bar, your repositories a sidebar card with New in its heading.

- **Tidier pages (#152).** The repository sidebar is a column of cards with shaded headings: Diffusion in one card (Takes from and Diffuses to, each with its pill), the ten most recently moved bookmarks with a link to the rest, and the hub's delegate key shown with the OxygenHub mark. The code tree has a shaded head with the latest change and the history, and folder and file icons; the site bar has icons; the Diffusion tables share one column grid; Help › Coming from GitHub covers submodules and Renovate.

- **Admin › Runners › Images (#146):** every runner image, where it is and what uses it.

/// The full router: pages, API, protocol and static assets.

pub fn router(app: Shared) -> axum::Router {

}

/// Requests slower than this are logged, with their path (#145).

    res

}

/// Serve on the configured addresses until the process is told to stop.

pub async fn serve(app: Shared) -> anyhow::Result<()> {

    let router = router(app.clone());

    let events = data["events"].as_array().unwrap();

    assert!(events.iter().any(|e| e[1] == 1), "the proposals opened are marks: {data}");

    assert!(events.iter().all(|e| e[0].as_u64().unwrap() < repos.len() as u64));

    // The engine is served as WebAssembly.

    let res = oxygenhub::router(app.clone())

        .oneshot(Request::builder().uri("/static/backdrop/backdrop_bg.wasm").body(Body::empty()).unwrap())

    // Bob sees his own proposal on the public repository, never the private one's.

    let page = get(app, "/", Some(&bob)).await;

    assert!(page.body.contains("Your proposals</h2><span class=\"count-chip\">1</span>"), "{}", page.body);

    assert!(!page.body.contains("Hidden work"));

    assert!(page.body.contains("Waiting for your review</h2><span class=\"count-chip\">0</span>"));