fix(cache-bust): close FE-024 gaps so every JS/CSS gets ?v=<sha>

The 2026-05-18 cache-busting system was only catching a fraction of
includes because:

1. FE-024 anti-pattern only matched `'<module>_static'` mount names
   (e.g. `'core_static'`, `'billing_static'`). The bare `'static'`
   mount — which is what every persona base.html uses for shared JS,
   CSS, and Tailwind output — never matched.
2. The rule explicitly excluded `base.html` files, which are exactly
   where most of the shared JS/CSS includes live.

User reported only a handful of files had `?v=` in their Network tab.
Swept 5 persona base.html + 15 standalone templates (login/register/
forgot/reset password, error pages, onboarding, invitation-accept,
admin module-info/config, etc.) — 53 url_for('static', ...) refs for
.js/.css converted to static_v(request, 'static', ...).

Then tightened FE-024:
- Added an anti-pattern for the bare `'static'` mount.
- Dropped `base.html` from exceptions (kept `partials/`).

Re-running the validator: same 126-warning baseline, 0 FE-024 hits.

Now every deploy flips the `?v=<sha>` query string on every shared
asset; browsers refetch automatically without a hard refresh.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/templates/admin/base.html

@@ -11,13 +11,13 @@
     <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700;800&display=swap" rel="stylesheet" />
 
     <!-- Tailwind CSS v4 (built locally via standalone CLI) -->
-    <link rel="stylesheet" href="{{ url_for('static', path='admin/css/tailwind.output.css') }}" />
+    <link rel="stylesheet" href="{{ static_v(request, 'static', path='admin/css/tailwind.output.css') }}" />
 
     <!-- Flag Icons CSS (for language selector) with local fallback -->
     <link
         rel="stylesheet"
         href="https://cdn.jsdelivr.net/npm/flag-icons@7.2.3/css/flag-icons.min.css"
-        onerror="this.onerror=null; this.href='{{ url_for('static', path='shared/css/store/flag-icons.min.css') }}';"
+        onerror="this.onerror=null; this.href='{{ static_v(request, 'static', path='shared/css/store/flag-icons.min.css') }}';"
     />
 
     <!-- Alpine Cloak -->
@@ -29,7 +29,7 @@
     <link
         rel="stylesheet"
         href="https://cdn.jsdelivr.net/npm/tom-select@2.4.1/dist/css/tom-select.default.min.css"
-        onerror="this.onerror=null; this.href='{{ url_for('static', path='shared/css/store/tom-select.default.min.css') }}';"
+        onerror="this.onerror=null; this.href='{{ static_v(request, 'static', path='shared/css/store/tom-select.default.min.css') }}';"
     />
     <!-- Tom Select Dark Mode Overrides -->
     <style>
@@ -76,7 +76,7 @@
     {% block quill_css %}{% endblock %}
 
     <!-- Dev debug toolbar (dev only — auto-hides in production, must load early for interceptors) -->
-    <script src="{{ url_for('static', path='shared/js/dev-toolbar.js') }}"></script>
+    <script src="{{ static_v(request, 'static', path='shared/js/dev-toolbar.js') }}"></script>
 
     {% block extra_head %}{% endblock %}
 </head>
@@ -104,19 +104,19 @@
     <script>window.FRONTEND_TYPE = '{{ frontend_type | default("admin") }}';</script>
 
     <!-- 1. FIRST: Log Configuration -->
-    <script defer src="{{ url_for('static', path='shared/js/log-config.js') }}"></script>
+    <script defer src="{{ static_v(request, 'static', path='shared/js/log-config.js') }}"></script>
 
     <!-- 2. SECOND: Icons (before Alpine.js) -->
-    <script defer src="{{ url_for('static', path='shared/js/icons.js') }}"></script>
+    <script defer src="{{ static_v(request, 'static', path='shared/js/icons.js') }}"></script>
 
     <!-- 3. THIRD: Alpine.js Base Data -->
     <script src="{{ static_v(request, 'core_static', path='admin/js/init-alpine.js') }}"></script>
 
     <!-- 4. FOURTH: Utils (standalone utilities) -->
-    <script defer src="{{ url_for('static', path='shared/js/utils.js') }}"></script>
+    <script defer src="{{ static_v(request, 'static', path='shared/js/utils.js') }}"></script>
 
     <!-- 4b. i18n Support -->
-    <script defer src="{{ url_for('static', path='shared/js/i18n.js') }}"></script>
+    <script defer src="{{ static_v(request, 'static', path='shared/js/i18n.js') }}"></script>
     <script>
         // Initialize i18n with current language and preload modules
         // Wrapped in DOMContentLoaded so deferred i18n.js has loaded
@@ -127,7 +127,7 @@
     </script>
 
     <!-- 5. FIFTH: API Client (depends on Utils) -->
-    <script defer src="{{ url_for('static', path='shared/js/api-client.js') }}"></script>
+    <script defer src="{{ static_v(request, 'static', path='shared/js/api-client.js') }}"></script>
 
     <!-- 6. SIXTH: Tom Select with CDN fallback -->
     <script>
@@ -167,6 +167,6 @@
 
     <!-- 10. LAST: Alpine.js v3 (must be last defer script — auto-initializes on load) -->
     <script defer src="https://cdn.jsdelivr.net/npm/alpinejs@3.13.3/dist/cdn.min.js"
-            onerror="var s=document.createElement('script');s.defer=true;s.src='{{ url_for('static', path='shared/js/lib/alpine.min.js') }}';document.head.appendChild(s);"></script>
+            onerror="var s=document.createElement('script');s.defer=true;s.src='{{ static_v(request, 'static', path='shared/js/lib/alpine.min.js') }}';document.head.appendChild(s);"></script>
 </body>
 </html>