Review feedback

Dockerfile

@@ -7,11 +7,24 @@ WORKDIR /build
 # this. The trailing slash matters — it becomes <base href> and the service
 # worker (ngsw.json) URL prefix.
 ARG BASE_HREF=/
+# Toggle the built-in PWA service worker. Defaults to "enabled" so prod images
+# ship the full offline-capable PWA unchanged. The dev / e2e compose overrides
+# this to "disabled" (see docker-compose.dev.yml): it swaps Angular's real
+# ngsw-worker.js for a self-unregistering safety worker and drops ngsw.json, so
+# a `--build` rebuild is never shadowed by a stale, client-cached app shell on
+# the fixed localhost origin. (Docker layer caching already busts the SPA build
+# on FE source changes; this handles the browser-side service-worker cache.)
+ARG SERVICE_WORKER=enabled
 COPY frontend/package.json frontend/package-lock.json ./
 RUN npm ci
 COPY frontend/ ./
-RUN npm run build -- --base-href="$BASE_HREF"
 # Angular's application builder outputs to dist/frontend/browser/
+RUN npm run build -- --base-href="$BASE_HREF" \
+    && if [ "$SERVICE_WORKER" = "disabled" ]; then \
+         echo "Neutralising service worker for dev/e2e image"; \
+         rm -f dist/frontend/browser/ngsw.json; \
+         cp safety-worker.js dist/frontend/browser/ngsw-worker.js; \
+       fi
 
 # Stage 2: runtime
 FROM python:3.13-slim