V1.12.3: live updates behind any proxy, fewer requests

- Live updates start on plain requests and move up to a websocket when
  one gets through. The site used to ask for the websocket first, with
  no way back: behind a proxy that does not pass the upgrade, nothing
  live arrived at all.
- A browser asks the API's leave before a request, the site and the API
  being on different hosts. It now remembers the answer for two hours,
  where it used to ask before nearly every request.
- A built file is kept by the browser for good: its name changes when
  its contents do. Each used to be checked again on every page load.
- For a real websocket through nginx, the blocks that pass requests to
  the API need "proxy_http_version 1.1", "proxy_set_header Upgrade
  $http_upgrade" and "proxy_set_header Connection "upgrade"".

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/package.json

@@ -1,6 +1,6 @@
 {
   "name": "backend",
-  "version": "1.12.2",
+  "version": "1.12.3",
   "private": true,
   "type": "commonjs",
   "main": "src/index.js",

backend/src/app.js

@@ -11,7 +11,10 @@ const notesRoutes = require('./routes/notes.routes');
 function createApp() {
   const app = express();
 
-  app.use(cors({ origin: process.env.CORS_ORIGIN || 'http://localhost:5173' }));
+  // The site and the API are on different hosts, so a browser asks leave
+  // before each kind of request. maxAge lets it remember the answer (browsers
+  // cap it at two hours) and not ask again every time.
+  app.use(cors({ origin: process.env.CORS_ORIGIN || 'http://localhost:5173', maxAge: 7200 }));
   // Nothing in front of the API compresses for it (frp only tunnels), so the
   // JSON is gzipped here.
   app.use(compression());