Backend: add a cache-headers ETag weak-validator strategy for paginated list endpoints

[Baskarayelu]

📋 Description

cache-headers.ts sets caching headers, but paginated list endpoints (invoices, bids) currently can't emit a stable ETag because the response varies by cursor and the underlying data shifts. This issue adds a weak-ETag strategy keyed by (route, query-params, max-updated-at) so unchanged pages can be served 304.

Why this matters: list endpoints are read-heavy. A correct weak validator lets clients revalidate cheaply and cuts payload bytes, while the max-updated-at component guarantees the ETag changes whenever any row in the page changes.

🎯 Requirements & Context

• Compute a weak ETag W/"hash(route|params|maxUpdatedAt)" for list responses.
• Honor If-None-Match and return 304 when matching.
• Integrate with the pagination utility in pagination.ts to source the page's maxUpdatedAt.
• Never emit a strong ETag for collections (avoid byte-exact promises).

Context & constraints

• TypeScript, Express 5; jest + supertest. Must not break existing Last-Modified behavior.

🛠️ Suggested Execution

git checkout -b feature/list-weak-etag
npm --prefix backend test -- cache-headers

• Edge cases: empty page ETag stable; data change flips ETag; differing query params produce different ETags; If-None-Match mismatch returns 200.

Example commit message

feat(backend): add weak-ETag revalidation for paginated list endpoints

Keys a weak validator on route/params/maxUpdatedAt and serves 304 for
unchanged pages.

✅ Acceptance Criteria & Guidelines

Requirement	Target
Weak ETag + 304 revalidation	Required
ETag changes on data change	Required
Test coverage	≥ 95% of new logic
jest + lint clean	Required
Timeframe	96 hours from assignment

💬 Community & Support

Join Discord: https://discord.gg/VpngvTjWa — comment to claim. 🚀

[YfengJ]

Hi maintainers, I would like to apply for this issue if it is available. If assigned, I will keep the change focused on the weak-ETag strategy for paginated list endpoints, with deterministic tests for cache hits/invalidations and no unrelated API changes.