fix(cache-bust): close FE-024 gaps so every JS/CSS gets ?v=<sha>

The 2026-05-18 cache-busting system was only catching a fraction of
includes because:

1. FE-024 anti-pattern only matched `'<module>_static'` mount names
   (e.g. `'core_static'`, `'billing_static'`). The bare `'static'`
   mount — which is what every persona base.html uses for shared JS,
   CSS, and Tailwind output — never matched.
2. The rule explicitly excluded `base.html` files, which are exactly
   where most of the shared JS/CSS includes live.

User reported only a handful of files had `?v=` in their Network tab.
Swept 5 persona base.html + 15 standalone templates (login/register/
forgot/reset password, error pages, onboarding, invitation-accept,
admin module-info/config, etc.) — 53 url_for('static', ...) refs for
.js/.css converted to static_v(request, 'static', ...).

Then tightened FE-024:
- Added an anti-pattern for the bare `'static'` mount.
- Dropped `base.html` from exceptions (kept `partials/`).

Re-running the validator: same 126-warning baseline, 0 FE-024 hits.

Now every deploy flips the `?v=<sha>` query string on every shared
asset; browsers refetch automatically without a hard refresh.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/templates/storefront/base.html

@@ -37,20 +37,20 @@
     </style>
 
     {# Tailwind CSS v4 (built locally via standalone CLI) #}
-    <link rel="stylesheet" href="{{ url_for('static', path='storefront/css/tailwind.output.css') }}">
+    <link rel="stylesheet" href="{{ static_v(request, 'static', path='storefront/css/tailwind.output.css') }}">
 
     {# Flag Icons for Language Selector with local fallback #}
     <link
         rel="stylesheet"
         href="https://cdn.jsdelivr.net/npm/flag-icons@7.2.3/css/flag-icons.min.css"
-        onerror="this.onerror=null; this.href='{{ url_for('static', path='shared/css/store/flag-icons.min.css') }}';"
+        onerror="this.onerror=null; this.href='{{ static_v(request, 'static', path='shared/css/store/flag-icons.min.css') }}';"
     />
 
     {# Base Shop Styles #}
-    <link rel="stylesheet" href="{{ url_for('static', path='storefront/css/storefront.css') }}">
+    <link rel="stylesheet" href="{{ static_v(request, 'static', path='storefront/css/storefront.css') }}">
 
     {# Dev debug toolbar (dev only — auto-hides in production, must load early for interceptors) #}
-    <script src="{{ url_for('static', path='shared/js/dev-toolbar.js') }}"></script>
+    <script src="{{ static_v(request, 'static', path='shared/js/dev-toolbar.js') }}"></script>
 
     {% block extra_head %}{% endblock %}
 </head>
@@ -366,7 +366,7 @@
     <script>window.FRONTEND_TYPE = '{{ frontend_type | default("storefront") }}';</script>
 
     {# 1. Log Configuration (must load first) #}
-    <script defer src="{{ url_for('static', path='shared/js/log-config.js') }}"></script>
+    <script defer src="{{ static_v(request, 'static', path='shared/js/log-config.js') }}"></script>
 
     {# 2. Global Shop Configuration (resolved via PlatformSettingsService) #}
     <script>
@@ -378,16 +378,16 @@
     </script>
 
     {# 3. Icon System #}
-    <script defer src="{{ url_for('static', path='shared/js/icons.js') }}"></script>
+    <script defer src="{{ static_v(request, 'static', path='shared/js/icons.js') }}"></script>
 
     {# 4. Base Shop Layout (Alpine.js component - must load before Alpine) #}
     <script defer src="{{ static_v(request, 'core_static', path='storefront/js/storefront-layout.js') }}"></script>
 
     {# 5. Utilities #}
-    <script defer src="{{ url_for('static', path='shared/js/utils.js') }}"></script>
+    <script defer src="{{ static_v(request, 'static', path='shared/js/utils.js') }}"></script>
 
     {# 5b. i18n Support #}
-    <script defer src="{{ url_for('static', path='shared/js/i18n.js') }}"></script>
+    <script defer src="{{ static_v(request, 'static', path='shared/js/i18n.js') }}"></script>
     <script>
         // Initialize i18n with storefront language and preload modules
         // Wrapped in DOMContentLoaded so deferred i18n.js has loaded
@@ -398,14 +398,14 @@
     </script>
 
     {# 6. API Client #}
-    <script defer src="{{ url_for('static', path='shared/js/api-client.js') }}"></script>
+    <script defer src="{{ static_v(request, 'static', path='shared/js/api-client.js') }}"></script>
 
     {# 7. Page-specific JavaScript (MUST load before Alpine.js) #}
     {% block extra_scripts %}{% endblock %}
 
     {# 8. LAST: Alpine.js (must be last defer script — auto-initializes on load) #}
     <script defer src="https://cdn.jsdelivr.net/npm/alpinejs@3.13.3/dist/cdn.min.js"
-            onerror="var s=document.createElement('script');s.defer=true;s.src='{{ url_for('static', path='shared/js/lib/alpine.min.js') }}';document.head.appendChild(s);"></script>
+            onerror="var s=document.createElement('script');s.defer=true;s.src='{{ static_v(request, 'static', path='shared/js/lib/alpine.min.js') }}';document.head.appendChild(s);"></script>
 
     {# Toast notification container #}
     <div id="toast-container" class="fixed bottom-4 right-4 z-50"></div>

app/templates/storefront/errors/base.html

@@ -8,7 +8,7 @@
     <title>{% block title %}{{ status_code }} - {{ status_name }}{% endblock %}{% if store %} | {{ store.name }}{% endif %}</title>
 
     {# Tailwind CSS #}
-    <link rel="stylesheet" href="{{ url_for('static', path='storefront/css/tailwind.output.css') }}">
+    <link rel="stylesheet" href="{{ static_v(request, 'static', path='storefront/css/tailwind.output.css') }}">
 
     {# Store theme colors via CSS variables #}
     <style>

app/templates/storefront/unavailable.html

@@ -8,7 +8,7 @@
     <title>{{ title }}{% if store %} | {{ store.name }}{% endif %}</title>
 
     {# Tailwind CSS #}
-    <link rel="stylesheet" href="{{ url_for('static', path='storefront/css/tailwind.output.css') }}">
+    <link rel="stylesheet" href="{{ static_v(request, 'static', path='storefront/css/tailwind.output.css') }}">
 
     {# Theme colors (use store theme if available, fallback to purple gradient) #}
     <style>