feat(web): wallpaper drag&drop upload + fix(hub): index.html no-cache

[oorabona]

1. Wallpaper drag&drop upload (feat, web)

The wallpaper settings already render an inline thumbnail grid (select/delete/None + an upload button).
This adds drag-and-drop directly onto that grid, matching the FontPicker pattern:

• useFileDrop wired onto the grid container with a "Drop image to add" overlay (theme-var styled —
  --nt-accent / --nt-accent-rgb, legible in both modes).
• The file-input button and drag&drop now share one uploadFiles() (extracted to wallpaperUpload.ts):
  multipart POST to /api/wallpapers (with the existing Authorization: Bearer), validated against
  WALLPAPER_EXTENSIONS / MAX_WALLPAPER_SIZE.
• The upload button is kept as a click-to-browse fallback.

Inline d&d (not a dedicated dialog) is the right fit here: a wallpaper is visual, and the grid shows all
wallpapers + the active one at a glance — a dialog would hide that behind a click. (The FontPicker uses a
dialog because fonts are a managed list; the patterns legitimately differ by content.)

New tests (wallpaperUpload.spec.ts): accepted dropped files go through the shared uploader; non-image
drops are filtered out.

2. index.html no-cache (fix, hub)

index.html was served with Cache-Control: max-age=3600, pinning the browser to stale Vite asset hashes
for up to an hour after a deploy (new builds didn't show on a normal reload). Serve it no-cache (must
revalidate); hashed /assets/* stay immutable.

This fix was reviewed in #54's gate but missed its commit (only web files were staged there); landing it
here.

Verification

• vitest packages/clients/web packages/hub → 2216 passed / 2 skipped / 0 failed; vue-tsc + hub tsc
  clean. (CSS/.vue aren't biome-linted; vue-tsc covers SFC typing.)

Gate

Orthogonal pre-PR gate: codex = CLEAN; copilot exogenously unavailable. Degraded GATE_OK.

The wallpaper d&d is a visual change — please confirm in the browser (drop an image onto the wallpaper
grid → it uploads and appears) before merge.