fix: add Cache-Control: no-store to 401 session responses in index.ts

The session-unauth path in index.ts used Response.json with only CORS_HEADERS,
bypassing the jsonResponse helper in handlers/keys.ts. Cache-Control was therefore
missing on 401 responses. Add it explicitly on the fallthrough path.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: Digidai

src/index.ts

@@ -216,7 +216,13 @@ export default {
       if (!session) {
         return Response.json(
           { error: "Unauthorized", message: "Valid session required" },
-          { status: 401, headers: CORS_HEADERS },
+          {
+            status: 401,
+            headers: {
+              ...CORS_HEADERS,
+              "Cache-Control": "no-store, private",
+            },
+          },
         );
       }