fix: session HUD syntax error + no-cache the app shell

- The roster card's empty-state string had a broken apostrophe escape
  ("who\\'s") that terminated the string early — a syntax error that killed the
  whole session.html script, so the HUD only rendered from a stale cached shell.
  Reworded to drop the apostrophe.
- Add a middleware that sets Cache-Control: no-cache on HTML/JS so a PWA can't
  keep serving a stale shell after a deploy (iOS heuristically caches when no
  cache header is present — the reason a hard refresh + reopen didn't update).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lyra/web/static/session.html

@@ -380,7 +380,7 @@
               <button class="mini" title="Rename / fix" onclick="renamePlayer(${v.id}, '${esc(v.name||'').replace(/'/g,"\\'")}')">✎</button>
               ${v.last_note ? `<div class="note-meta">“${esc(v.last_note)}”</div>` : ''}
             </li>`).join('')}</ul>`
-            : '<p class="empty">No roster yet — tell Lyra who\\'s at the table.</p>'}
+            : '<p class="empty">No roster yet — tell Lyra who is at the table.</p>'}
         </div>
 
         <div class="card">