fix: prevent edge cache from bypassing Cloudflare Access on SPA shell

[tbjers]

Summary

• GET / was returning CF-Cache-Status: HIT for unauthenticated requests — Cloudflare's edge cache served index.html directly, bypassing Access entirely. No CF_Authorization cookie was ever minted.
• Every subsequent /api/projects call hit requireAccess() with no cookie → 401 {"error":"Missing Access token"} → SvelteKit load threw → styled 500 error page.
• This affected anonymous windows and any session where the edge cache was warm.

Fix: Add Cache-Control: no-store to /* in _headers so the SPA shell is never stored at the edge, ensuring Access evaluates every navigation request. Re-enable immutable long-lived caching for content-hashed JS/CSS chunks (/_app/immutable/*) and static font files (/fonts/*) so asset performance is unaffected.

Also picks up the font-src 'self' CSP directive from the font-fix branch that hasn't landed on main yet.

Test plan

• Deploy and visit the site in an anonymous/private window — should be redirected to Cloudflare Access login instead of hitting the 500 error page
• After authenticating, dashboard should load with projects and sparklines as shown in the design screenshots
• Verify /_app/immutable/*.js responses still have long-lived cache headers (check Network tab → Cache-Control: public, max-age=31536000, immutable)
• Verify /fonts/*.woff2 responses have long-lived cache headers

🤖 Generated with Claude Code