Entry HTML served with max-age=600 causes ChunkLoadError after deploys

## Summary

After a webui deploy, users hit ChunkLoadError (blank page) until a hard reload, because the SPA entry HTML is cached for 10 minutes and keeps referencing content-hashed chunks the new build already removed.

## Evidence

```
$ curl -sI https://staging.open-vsx.org/
HTTP/2 200
content-type: text/html
cache-control: public, max-age=600
via: 1.1 varnish
x-served-by: cache-fra-...
```

The entry HTML is reusable for 600s with no revalidation, so for ~10 min after a deploy it points at old chunk hashes → 404 → ChunkLoadError. Hard reload fixes it only because it bypasses the cache.

## Where it comes from

The webui is served through the Spring Boot server, whose WebConfig has no addResourceHandlers override, so index.html and the immutable hashed assets share one uniform policy. This deployment additionally injects content-security-policy / strict-transport-security (not present in the server code), so there's a Fastly layer in front that may also be stamping max-age=600.

## Requested change

Ensure the origin/edge serves text/html (the entry) with Cache-Control: no-cache, while /assets/** stays public, max-age=31536000, immutable.

If Fastly overrides text/html, align the VCL to honor origin (or set no-cache) for HTML and keep immutable for hashed assets.
Code-level companion tracked upstream: .

## Verification

```
curl -sI https://staging.open-vsx.org/ # expect: cache-control: no-cache
curl -sI https://staging.open-vsx.org/assets/.js # expect: public, max-age=31536000, immutable
```

Locate the Spring Boot server's WebConfig and the Fastly/VCL deployment configuration, then determine which layer sets the HTML and asset cache policies. Run the provided curl checks against the staging entry HTML and a hashed asset; done means HTML returns no-cache while hashed assets return public, max-age=31536000, immutable.

Written by the indexing model from the issue text.