fix(demo-service): force inline Content-Disposition to prevent download

- All responses (HTML, CSS, JS, images) now have Content-Disposition: inline
- Add Cache-Control: no-store to bust any cached attachment response
- 401/404 error pages: inline, text/html, no-store

home-apps/demo-service/service.py

@@ -144,11 +144,17 @@ async def site_content(path: str = "", request: Request = None):
     site_name = parts[0]
     sub = parts[1] if len(parts) > 1 else ""
     if not site_name or not site_exists(site_name):
-        return HTMLResponse(AUTH_REQUIRED_HTML, status_code=404)
+        resp = HTMLResponse(AUTH_REQUIRED_HTML, status_code=404)
+        resp.headers["Content-Disposition"] = "inline"
+        resp.headers["Cache-Control"] = "no-store"
+        return resp
     visible = is_site_visible(site_name)
     if not visible:
         if not check_auth(request):
-            return HTMLResponse(AUTH_REQUIRED_HTML, status_code=401)
+            resp = HTMLResponse(AUTH_REQUIRED_HTML, status_code=401)
+            resp.headers["Content-Disposition"] = "inline"
+            resp.headers["Cache-Control"] = "no-store"
+            return resp
     site_dir = DEMO_ROOT / site_name
     target = (site_dir / sub) if sub else (site_dir / "index.html")
     if not target.exists():
@@ -159,15 +165,23 @@ async def site_content(path: str = "", request: Request = None):
                     target = p
                     break
         if not target.exists():
-            return HTMLResponse(AUTH_REQUIRED_HTML, status_code=404)
+            resp = HTMLResponse(AUTH_REQUIRED_HTML, status_code=404)
+            resp.headers["Content-Disposition"] = "inline"
+            resp.headers["Cache-Control"] = "no-store"
+            return resp
     if target.is_dir():
         target = target / "index.html"
         if not target.exists():
-            return HTMLResponse(AUTH_REQUIRED_HTML, status_code=404)
+            resp = HTMLResponse(AUTH_REQUIRED_HTML, status_code=404)
+            resp.headers["Content-Disposition"] = "inline"
+            resp.headers["Cache-Control"] = "no-store"
+            return resp
     # HTML files render inline; others (CSS, JS, images) are served as files
     if target.suffix == ".html":
         return HTMLResponse(target.read_text())
-    return FileResponse(target)
+    resp = FileResponse(target)
+    resp.headers["Content-Disposition"] = "inline"
+    return resp
 
 @app.get("/api/sites")
 def list_sites(request: Request):