fix(web): cache-busting query moved with app.css's mtime only

base.html stamps the same asset_version() value onto both app.css and
app.js's <link>/<script> tags, but the value was computed from app.css's
mtime alone. A JS-only deploy left it unchanged, so app.js's URL stayed
byte-identical to the previous deploy -- nothing forced a browser holding
that URL cached to refetch it.

Extracted into _static_asset_version(web_dir), keyed to the newer of the
two files' mtimes, and unit-tested directly (a JS-only mtime bump now
changes the value; both-missing degrades to "0").

tests/python/test_web_app.py

@@ -8,6 +8,7 @@ real host state (disk, systemd) leaks into the assertions either.
 
 from __future__ import annotations
 
+import os
 import shutil
 from collections import namedtuple
 from pathlib import Path
@@ -337,3 +338,31 @@ def test_dashboard_lists_a_running_vm_under_its_run(
 
     assert resp.status_code == 200
     assert "job1" in resp.text
+
+
+# ── _static_asset_version ────────────────────────────────────────────────
+
+
+def test_asset_version_moves_when_only_js_changes(tmp_path: Path) -> None:
+    """A JS-only deploy must still change the shared cache-busting query --
+    otherwise the browser keeps serving whatever app.js it cached under the
+    unchanged URL (app.css's mtime alone used to drive this value)."""
+    static_dir = tmp_path / "static"
+    static_dir.mkdir()
+    css = static_dir / "app.css"
+    js = static_dir / "app.js"
+    css.write_text("body{}")
+    js.write_text("//v1")
+    os.utime(css, (1_000_000, 1_000_000))
+    os.utime(js, (1_000_000, 1_000_000))
+
+    before = app_module._static_asset_version(tmp_path)
+
+    os.utime(js, (2_000_000, 2_000_000))  # touch only the JS file
+    after = app_module._static_asset_version(tmp_path)
+
+    assert after != before
+
+
+def test_asset_version_degrades_to_zero_when_both_assets_are_missing(tmp_path: Path) -> None:
+    assert app_module._static_asset_version(tmp_path) == "0"