feat(boardwalk): expose the admin build id and show a reload banner when a new build is deployed (quick-261028-rqb)

- boardwalk.BuildID hashes the dist tree plus the binary's build info once
  per handler; X-Summer-Build on every response, {prefix}/build.json and the
  summer-admin-build meta carry it
- the SPA reads the booted build, re-checks on focus, visibility and every
  5 minutes, and shows UpdateBanner on a different build

docs/backend/admin-spa.md

@@ -16,8 +16,10 @@ cabana mounts the SPA under the admin prefix, `backend.uri` (`/backend` by defau
 - Paths under `api/` that no API route matches return the admin API's JSON `not_found` error, never the SPA.
 - Hashed files under `assets/` are cached for a long time; `index.html` is never cached.
 - Every response carries a restrictive Content-Security-Policy (`frame-ancestors 'none'; base-uri 'none'; object-src 'none'; script-src 'self'; form-action 'self'; frame-src 'none'`: scripts only from the admin origin, no native form post to another origin, no framed content), frame denial, `nosniff`, a same-origin referrer policy and `noindex, nofollow`.
+- Every response also carries the build id in the `X-Summer-Build` header (`boardwalk.BuildHeader`), the `api/` misses included.
+- `GET <prefix>/build.json` answers `{"build":"<id>"}` with `Cache-Control: no-store`, so an open tab can ask which build the server runs.
 
-The build is path-agnostic: `index.html` holds a placeholder (`boardwalk.BaseToken`) that `boardwalk.RewriteIndex` replaces with the prefix once, when the handler is built. A build without the placeholder fails the start-up.
+The build is path-agnostic: `index.html` holds a placeholder (`boardwalk.BaseToken`) that `boardwalk.RewriteIndex` replaces with the prefix once, when the handler is built. A build without the placeholder fails the start-up. A second placeholder, `boardwalk.BuildToken`, is replaced with the build id (`boardwalk.BuildID`: the admin build plus the binary's build information, so every redeploy of a different binary gets a new id); an index without it is served as it is and the SPA's version check stays off.
 
 A plugin route under the admin prefix also fails the start-up: the SPA and the admin API own that whole path.
 
@@ -39,6 +41,10 @@ The button at the top of the plugin rail switches the theme: each click moves fr
 
 When the server offers more than one admin language (`meta.locales` of `GET .../lang`), the user menu lists them under Language, each named in its own language. Choosing one saves it as the administrator's `locale` preference, caches it in `localStorage` (`summer-admin.locale`) and reloads the page, so the strings, navigation, settings, schemas and validation messages all come back in that language, in any browser and whatever `Accept-Language` says. A form with unsaved changes asks before the reload.
 
+## New versions
+
+A tab opened before a deploy would otherwise keep running the old admin against the new server, because the session refreshes silently. The SPA reads the build it booted with from the `summer-admin-build` meta of the served `index.html` and asks `<prefix>/build.json` again when the window gets focus, when the tab becomes visible and every 5 minutes while it is visible, at most once every 30 seconds. When the server answers a different build, a banner at the bottom right says that a new version is available, with Reload and Close buttons. The SPA never reloads by itself: Reload goes through the usual page reload, so a form with unsaved changes still asks first, and Close hides the banner until yet another build is deployed. When the served index carries no build, as under the Vite dev server, the check is off.
+
 ## Keyboard shortcuts
 
 As in WinterCMS, a shortcut presses a button on the screen. Ctrl and Cmd are both accepted on every platform; the tooltips name Cmd (⌘) on macOS.