test: strengthen HTML preview cache regression coverage

Per review feedback:
- Frontend: assert exact fetch(mediaUrl, {cache:'no-store'}) in
  loadHtmlInline body, not just 'fetch(mediaUrl' prefix (too broad,
  other fetch calls match the prefix)
- Backend: assert Cache-Control: no-store on both attachment and inline
  HTML responses in test_html_media_endpoint_inline_requires_csp_sandbox
- Both assertions fail independently if either the frontend no-store
  option or backend no-store policy is reverted

tests/test_media_inline.py

@@ -849,6 +849,12 @@ class TestMediaEndpointIntegration(unittest.TestCase):
                 any("sandbox allow-scripts" == h for h in headers.get_all("Content-Security-Policy", []))
             )
             self.assertEqual(body, html_bytes)
+            # HTML responses must use no-store to prevent stale preview on
+            # re-send of the same MEDIA: link (attachment branch).
+            self.assertEqual(
+                headers.get("Cache-Control"), "no-store",
+                "HTML attachment must use Cache-Control: no-store"
+            )
 
             body, status, headers = self._get(f"/api/media?path={encoded}&inline=1")
             self.assertEqual(status, 200)
@@ -859,6 +865,11 @@ class TestMediaEndpointIntegration(unittest.TestCase):
                 any("sandbox allow-scripts" == h for h in headers.get_all("Content-Security-Policy", []))
             )
             self.assertEqual(body, html_bytes)
+            # Inline HTML preview must also use no-store (inline branch).
+            self.assertEqual(
+                headers.get("Cache-Control"), "no-store",
+                "Inline HTML preview must use Cache-Control: no-store"
+            )
         finally:
             pathlib.Path(tmp_path).unlink(missing_ok=True)
 

tests/test_pdf_html_preview.py

@@ -197,7 +197,10 @@ class TestLoadHtmlInlineFunction:
         body = ui[idx:idx + 1200]
         assert 'const mediaSessionId=' in body
         assert "'&session_id='+encodeURIComponent(mediaSessionId)" in body
-        assert 'fetch(mediaUrl' in body
+        assert "fetch(mediaUrl, {cache:'no-store'})" in body, (
+            "loadHtmlInline must fetch with cache:'no-store' to bypass "
+            "browser cache for stale HTML preview (got body without no-store)"
+        )
         assert "const publicMediaUrl='api/media?path='+encodeURIComponent(path);" in body
         assert "const openUrl=publicMediaUrl+'&inline=1';" in body