fix: 终审微修（admin no-cache/PII挂账/死配置清理）

Co-Authored-By: Claude Code <noreply@anthropic.com>

tests/test_admin_serving.py

@@ -80,6 +80,36 @@ def test_admin_assets_served(admin_client):
     assert "admin bundle" in r.text
 
 
+# ---- no-cache 协商缓存(终审微修) --------------------------------------------
+
+
+def test_admin_responses_no_cache(admin_client):
+    # /admin 全前缀(含重定向、index、hash assets)带 no-cache: SPA 的
+    # index.html 引用带 hash 的 assets,发版后管理员端旧 index 被启发式
+    # 缓存会引旧 assets 白屏——与 2026-09-30 widget.js 线上事件同类,
+    # 协商缓存让 index 每次轻量校验(未变 304)
+    r = admin_client.get("/admin", follow_redirects=True)
+    assert r.status_code == 200
+    assert r.headers["cache-control"] == "no-cache"
+    r = admin_client.get("/admin/")
+    assert r.status_code == 200
+    assert r.headers["cache-control"] == "no-cache"
+    r = admin_client.get("/admin/assets/app.js")
+    assert r.status_code == 200
+    assert r.headers["cache-control"] == "no-cache"
+
+
+def test_platform_api_not_no_cache(admin_client):
+    # 负面钉位: 中间件只覆盖静态面(/static/ 与 /admin),/api/platform
+    # 响应不带 no-cache——API 的缓存语义归端点自己
+    r = admin_client.post(
+        "/api/platform/auth/login",
+        json={"username": "nope", "password": "bad"},
+    )
+    assert r.status_code == 401
+    assert "cache-control" not in r.headers
+
+
 # ---- SPA fallback 边界 -------------------------------------------------------