fix: change Cache-Control from max-age to no-cache for proper ETag validation

Root cause identified from network logs:
- Browser was serving from disk cache without checking server
- max-age=300 allowed browser to cache for 5 minutes without revalidation
- Even with must-revalidate, browser only checks AFTER max-age expires
- This caused stale data to be served from disk cache

Solution:
- Changed to: Cache-Control: private, no-cache, must-revalidate
- no-cache forces browser to revalidate with server on EVERY request
- Browser can still cache, but must check ETag first
- If ETag matches, server returns 304 (fast, no body)
- If ETag differs, server returns 200 with fresh data

This ensures immediate cache invalidation when user data changes
while still benefiting from ETag-based 304 responses.

Author: roncodes

src/Http/Controllers/Internal/v1/UserController.php

@@ -197,7 +197,7 @@ public function current(Request $request)
             return response()->json(['user' => $cachedData])
                 ->setEtag($etag, true)  // Use weak ETag for compression compatibility
                 ->setLastModified($user->updated_at)
-                ->header('Cache-Control', 'private, max-age=' . UserCacheService::getBrowserCacheTTL() . ', must-revalidate')
+                ->header('Cache-Control', 'private, no-cache, must-revalidate')
                 ->header('X-Cache-Hit', 'true');
         }
 
@@ -216,7 +216,7 @@ public function current(Request $request)
         return response()->json(['user' => $userArray])
             ->setEtag($etag, true)  // Use weak ETag for compression compatibility
             ->setLastModified($user->updated_at)
-            ->header('Cache-Control', 'private, max-age=' . UserCacheService::getBrowserCacheTTL() . ', must-revalidate')
+            ->header('Cache-Control', 'private, no-cache, must-revalidate')
             ->header('X-Cache-Hit', 'false');
     }