api: send Cache-Control no-store on /api responses so browsers can't cache stale auth state (e.g. garmin connected)

backend/app/main.py

@@ -234,6 +234,18 @@ app.add_middleware(
     allow_headers=["*"],
 )
 
+
+@app.middleware("http")
+async def no_store_api_responses(request, call_next):
+    """Authenticated API data must never be cached by the browser/proxy. Without
+    this, browsers (notably Edge) can heuristically cache GETs like
+    /api/garmin-sync/config and keep showing stale state (e.g. "not connected")
+    until a manual cache clear."""
+    response = await call_next(request)
+    if request.url.path.startswith("/api/"):
+        response.headers["Cache-Control"] = "no-store"
+    return response
+
 app.include_router(auth.router, prefix="/api/auth", tags=["auth"])
 app.include_router(activities.router, prefix="/api/activities", tags=["activities"])
 app.include_router(routes.router, prefix="/api/routes", tags=["routes"])

milevault_export/backend/app/main.py

@@ -216,6 +216,19 @@ app.add_middleware(
     allow_headers=["*"],
 )
 
+
+@app.middleware("http")
+async def no_store_api_responses(request, call_next):
+    """Authenticated API data must never be cached by the browser/proxy. Without
+    this, browsers (notably Edge) can heuristically cache GETs like
+    /api/garmin-sync/config and keep showing stale state (e.g. "not connected")
+    until a manual cache clear."""
+    response = await call_next(request)
+    if request.url.path.startswith("/api/"):
+        response.headers["Cache-Control"] = "no-store"
+    return response
+
+
 app.include_router(auth.router, prefix="/api/auth", tags=["auth"])
 app.include_router(activities.router, prefix="/api/activities", tags=["activities"])
 app.include_router(routes.router, prefix="/api/routes", tags=["routes"])