fix stale SERVER_URL when changing env var in Docker (#1714)

settings.js (which injects SERVER_URL into the browser) was served
without Cache-Control headers, causing Cloudflare and other reverse
proxies to cache the old value indefinitely. Additionally, when
SERVER_LOCK is enabled, the persisted server URL in localStorage was
never compared against the current window.SERVER_URL, so same-browser
sessions kept using the old server even after settings.js was updated.

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

ng.conf.template

@@ -20,9 +20,11 @@ server {
 
   location ${PUBLIC_PATH}settings.js {
     alias /etc/nginx/conf.d/settings.js;
+    add_header Cache-Control "no-store";
   }
 
   location ${PUBLIC_PATH}/settings.js {
     alias /etc/nginx/conf.d/settings.js;
+    add_header Cache-Control "no-store";
   }
 }

src/renderer/router/app-outlet.tsx

@@ -1,20 +1,37 @@
 import { useMemo } from 'react';
 import { Navigate, Outlet } from 'react-router';
 
+import { isServerLock } from '/@/renderer/features/action-required/utils/window-properties';
 import { AppRoute } from '/@/renderer/router/routes';
-import { useCurrentServer } from '/@/renderer/store';
+import { useAuthStoreActions, useCurrentServer } from '/@/renderer/store';
+
+const normalizeUrl = (url: string) => url.replace(/\/$/, '');
 
 export const AppOutlet = () => {
     const currentServer = useCurrentServer();
+    const { deleteServer, setCurrentServer } = useAuthStoreActions();
 
     const isActionsRequired = useMemo(() => {
+        // When SERVER_LOCK is enabled and the configured URL has changed,
+        // clear the stale session so the user re-authenticates against the new server.
+        if (isServerLock() && currentServer && window.SERVER_URL) {
+            const configuredUrl = normalizeUrl(window.SERVER_URL);
+            const persistedUrl = normalizeUrl(currentServer.url);
+
+            if (configuredUrl !== persistedUrl) {
+                deleteServer(currentServer.id);
+                setCurrentServer(null);
+                return true;
+            }
+        }
+
         const isServerRequired = !currentServer;
 
         const actions = [isServerRequired];
         const isActionRequired = actions.some((c) => c);
 
         return isActionRequired;
-    }, [currentServer]);
+    }, [currentServer, deleteServer, setCurrentServer]);
 
     if (isActionsRequired) {
         return <Navigate replace to={AppRoute.ACTION_REQUIRED} />;