fix(server): no cache

apps/server/src/app.ts

@@ -74,6 +74,16 @@ async function buildApp(deps: AppDeps) {
   const logger = useLogger('app').useGlobalConfig()
 
   const app = new Hono<HonoEnv>()
+    .use('*', async (c, next) => {
+      await next()
+
+      // NOTICE: All API responses should be non-cacheable. Auth responses can
+      // carry session state through redirects, and stale API payloads are not
+      // safe to serve from edge caches after user/account mutations.
+      c.res.headers.set('Cache-Control', 'no-store, no-cache, private, max-age=0')
+      c.res.headers.set('Pragma', 'no-cache')
+      c.res.headers.set('Expires', '0')
+    })
     .use(
       '/api/*',
       cors({

apps/server/src/libs/auth.ts

@@ -31,6 +31,15 @@ export function createAuth(db: Database, env: Env, metrics?: AuthMetrics | null)
       enabled: true,
     },
 
+    session: {
+      // NOTICE: keep a short-lived signed session cache cookie so follow-up
+      // session reads avoid hitting the database on every request.
+      cookieCache: {
+        enabled: true,
+        maxAge: 60 * 5,
+      },
+    },
+
     baseURL: env.API_SERVER_URL,
     trustedOrigins: request => getAuthTrustedOrigins(env, request),