Preserve legacy cache rules and pin service worker bytes at boot

server/server.js

@@ -350,7 +350,7 @@ registerCatalogRoutes(app, { resolveListener: recommendationListener });
 // ============================================================================
 
 // GET /api/version
-// Returns version string + a build tag that changes on every server restart/deploy.
+// Returns version and a deterministic tag that changes only with shipped files.
 // Clients poll this to detect when a new build is live and prompt a reload.
 app.get('/api/manifest', (c) => {
   const etag = `"${BUILD_TAG}"`;
@@ -2432,15 +2432,9 @@ app.post('/api/admin/p2p/revoke', notes.requireAdminOrToken, async (c) => {
 // Served with no-store cache headers so browsers always re-fetch it and
 // pick up the substituted value rather than a browser-cached stale copy.
 // ============================================================================
-let _swSource = null;
+const _swSource = assets.swSource;
 app.get('/sw.js', (c) => {
-  if (!_swSource) {
-    try {
-      _swSource = readFileSync('./public/sw.js', 'utf8');
-    } catch {
-      return c.text('Service worker not found', 404);
-    }
-  }
+  if (_swSource === null) return c.text('Service worker not found', 404);
   // Inject the build tag: replace the whole fallback expression with the
   // real value. Matched by REGEX, not an exact string — an exact match broke
   // the moment the fallback literal in sw.js was bumped ('v1.0.3' → 'v1.0.4'),