Go's MIME table has no .webmanifest entry, so http.FileServer sniffed the PWA web
app manifest as text/plain. mime.AddExtensionType at package load makes TypeByExtension
authoritative. A correctness nit (the manifest spec parses by content and nosniff does
not reject manifests), but a PWA server should label its manifest correctly.
- Cache-Control per file: no-cache for index.html + service workers, immutable 1y for
content-hashed assets, 1h for the rest (Vite/CRA/Angular). Closes the stale-release
trap at the HTTP layer that the v1.6.0 image fix closed at the container layer.
- SPA fallback scoped to navigation: a missing asset (path w/ extension) or a non-HTML
Accept now returns 404 instead of index.html (no more HTML-as-JS 'Unexpected token <').
- X-Content-Type-Options: nosniff on every response.
- Image runs as a non-root 'spa' user.
- README: caching table, fallback contract, and the Angular dist/<project>/browser/ note.
Rene Nochebuena