fix: session HUD syntax error + no-cache the app shell

- The roster card's empty-state string had a broken apostrophe escape
  ("who\\'s") that terminated the string early — a syntax error that killed the
  whole session.html script, so the HUD only rendered from a stale cached shell.
  Reworded to drop the apostrophe.
- Add a middleware that sets Cache-Control: no-cache on HTML/JS so a PWA can't
  keep serving a stale shell after a deploy (iOS heuristically caches when no
  cache header is present — the reason a hard refresh + reopen didn't update).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lyra/web/server.py

@@ -50,6 +50,16 @@ def _last_user_message(messages: list[dict]) -> str:
 def create_app() -> FastAPI:
     app = FastAPI(title="Lyra Web")
 
+    @app.middleware("http")
+    async def _no_stale_shell(request: Request, call_next):
+        """Always revalidate HTML/JS so a PWA can't serve a stale app shell after a
+        deploy (iOS applies heuristic caching when no cache header is set)."""
+        resp = await call_next(request)
+        ct = resp.headers.get("content-type", "")
+        if "text/html" in ct or "javascript" in ct:
+            resp.headers["Cache-Control"] = "no-cache, must-revalidate"
+        return resp
+
     @app.get("/_health")
     async def health() -> dict:
         return {"ok": True}