fix: cache backend API data so beekeepers can view it with no signal

The service worker only ever cached same-origin static assets/pages -
every real data call (colonies, apiaries, tasks, honey batches, ...)
was excluded, both because it targets a different origin (API_URL
points at a separate backend service, per .env.example) and because
of an explicit /api path exclusion. In practice this meant a
beekeeper opening the app at an apiary with no signal saw nothing at
all: not even data fetched minutes earlier on the same device, despite
the offline write-queue built earlier assuming the app itself stays
usable while offline.

The backend can't be matched by origin the way static assets are (the
service worker has no static knowledge of the runtime-configured
API_URL), so it's matched by path instead - every backend call goes
through /api/v1/. /api/runtime-config is explicitly excluded and
always fetched live, since a stale cached value would point the app
at the wrong backend. Error responses (4xx/5xx) are now never cached
either, closing a latent bug that could otherwise serve a stale 401
back after a token refresh.

Since the cache now holds real business data, it's cleared on logout
so it can't leak into the next person's session on a shared device.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

ApiCore-Frontend/src/lib/auth/auth-context.tsx

@@ -91,6 +91,13 @@ export function AuthProvider({ children }: { children: ReactNode }) {
     await logoutRequest();
     storeAccessToken(null);
     setUser(null);
+    // The service worker cache now holds real business data (colonies,
+    // tasks, etc.) for offline viewing - on a shared/handed-off device
+    // that must not survive into the next person's session.
+    if ("caches" in window) {
+      const keys = await caches.keys();
+      await Promise.all(keys.map((key) => caches.delete(key)));
+    }
   }, []);
 
   const hasPermission = useCallback(