Load the game once, not on every launch

The cold-start complaints — late fonts, zombies missing from the stats
screen — were one header. server.py sent no-cache, must-revalidate for
everything, so a fresh launch revalidated ~230 sprites and three fonts
before the game had a full set of frames. Assets under /assets now cache
for a year when the URL carries ?v= (changing the file changes the URL,
which is what SPRV is for) and a day when it does not; the fonts get a
?v= too. HTML and JS stay no-cache, so a deploy is still visible.

Two client-side halves of the same report: a dropped sprite request used
to be permanent for the session — the sheet stayed undefined and the
zombie drew as some other design — so each one gets one retry. And the
splash now holds its buttons back behind a loading bar until the last
sheet has landed and both faces are ready, instead of letting you open
the stats screen while half of it is still in flight.

The bar is driven by setInterval, not rAF: rAF does not fire in a hidden
tab, and an app that loads while backgrounded would come back to a frozen
bar and a menu with no buttons on it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server.py

@@ -142,7 +142,19 @@ class Handler(SimpleHTTPRequestHandler):
 
     # ---- static, with the headers the nginx conf used to set ----
     def end_headers(self):
-        if not self.path.startswith('/api/'):
+        if self.path.startswith('/api/'):
+            pass                         # reply() sets its own no-store
+        elif self.path.startswith('/assets/'):
+            # THE COLD-START FIX. no-cache here meant ~230 sprites, three fonts and the audio were
+            # REVALIDATED on every launch — 230 round trips before the game had a full set of
+            # frames, on a phone, sometimes over a connection that dropped a few. That is why the
+            # fonts arrived late and the stats screen showed gaps. A ?v= URL can be cached forever
+            # because changing the file changes the URL (see SPRV in render.js); anything
+            # unversioned gets a day, so a replaced logo or icon still lands without a year of
+            # staleness. The HTML and JS stay no-cache — that is what makes a deploy visible.
+            self.send_header('Cache-Control', 'public, max-age=31536000, immutable'
+                             if '?v=' in self.path else 'public, max-age=86400')
+        else:
             self.send_header('Cache-Control', 'no-cache, must-revalidate')
         super().end_headers()