[dvkam]

Fixes #579

Apply routing header rules through Hono's header API so configured values replace existing response headers. Keep authentication in control of private and no-store caching, including sign-in responses reached through rewrites or fallbacks.

Preserve last-match precedence and document that header rules also apply to matching error responses.

Validation:

• Reproduced the CSS and JavaScript failure in build and preview, then verified the fix.
• 188 focused routing, auth, compiler and real asset-binding tests pass.
• Workspace type checks pass, 33 tasks. Scoped formatting and lint pass.
• Full suite: 15,372 passed and 20 failed. Eighteen failures also reproduce on the base revision. The other two pass in isolation.