Version banner, File locations section, final CSP (no unsafe-inline styles, frame-src none, object-src none)

The MTR viewer draws PDFs with pdf.js instead of an iframe the server's frame-ancestors refused.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

frontend/src/auth/useEvents.ts

@@ -1,4 +1,5 @@
 import { useContext, useEffect, useRef, useState, useSyncExternalStore } from "react";
+import { streamReconnected } from "../lib/buildWatch";
 import { AuthCtx } from "./context";
 import { isScreen, SCREEN_LABELS } from "./roles";
 import type { PresenceUser } from "./types";
@@ -92,6 +93,13 @@ export function useEvents(sessionId: string | null, handlers: EventHandlers, opt
     if (!sessionId || typeof EventSource === "undefined") return;
     const es = new EventSource(eventsUrl(packetId, screen), { withCredentials: true });
 
+    // A second open on the same EventSource is a reconnect: the server may have restarted on a new build.
+    let opened = false;
+    es.addEventListener("open", () => {
+      if (opened) streamReconnected();
+      opened = true;
+    });
+
     es.addEventListener("session", (ev) => {
       const p = parse((ev as MessageEvent).data);
       if (p && typeof p === "object") {