JSON API: Cache-Control no-cache + ETag/304 revalidation

New JsonCacheHeaders middleware (outer, frontend stack): GET/HEAD 200 responses under /_json get a single Cache-Control: no-cache, Expires: 0 and a content md5 ETag; If-None-Match answers as empty 304. Logged-in visitors (fe_typo_user) keep TYPO3 headers. Expires: 0 is deliberate so mod_expires leaves the response alone. .htaccess: the global Header unset ETag now skips /_json (KEEP_ETAG env, carried across the mod_rewrite internal redirect as REDIRECT_KEEP_ETAG). Fulfils tickets 0011-FE point 3 and 0055-BE question 6; asset immutable headers were already live.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

public/.htaccess

@@ -439,9 +439,15 @@ Options -MultiViews
 	Header set X-Content-Type-Options "nosniff"
 </IfModule>
 
-# ETag removal
+# ETag removal - except for the /_json API: there TYPO3 (JsonCacheHeaders
+# middleware) sends a content ETag so browsers can revalidate with 304
+# (tickets 0011-FE / 0055-BE).
 <IfModule mod_headers.c>
-	Header unset ETag
+	SetEnvIf Request_URI "^/_json($|/)" KEEP_ETAG=1
+	# After the mod_rewrite internal redirect to index.php the variable
+	# is renamed REDIRECT_KEEP_ETAG - carry it back over:
+	SetEnvIf REDIRECT_KEEP_ETAG 1 KEEP_ETAG=1
+	Header unset ETag env=!KEEP_ETAG
 </IfModule>
 FileETag None