Fix overdue detection ignoring due_time, harden SW precache installs

Task.is_overdue only compared due_date to today, so a task due at 9am
stayed "not overdue" until midnight regardless of due_time (Gitea #7).
Now factors in due_time when the due date is today, mirrored in the
offline app's isTaskOverdue().

Also hardened the service worker's install step: cache.addAll() lets
the browser's HTTP cache satisfy each precache fetch, and since static
assets here send no Cache-Control/ETag (just Last-Modified), a
CACHE_NAME bump wasn't reliably guaranteed to pick up fresh files.
Forcing {cache: 'reload'} on each precache fetch fixes that.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

templates/sw.js

@@ -1,4 +1,4 @@
-{% load static %}const CACHE_NAME = 'keepitgoing-shell-v8';
+{% load static %}const CACHE_NAME = 'keepitgoing-shell-v10';
 const OFFLINE_URL = '{% url "offline" %}';
 const OFFLINE_TASKS_URL = '{% url "offline-tasks" %}';
 
@@ -18,7 +18,19 @@ const PRECACHE_URLS = [
 
 self.addEventListener('install', (event) => {
     event.waitUntil(
-        caches.open(CACHE_NAME).then((cache) => cache.addAll(PRECACHE_URLS))
+        caches.open(CACHE_NAME).then((cache) =>
+            // cache.addAll() lets the browser's own HTTP cache satisfy each
+            // fetch - static assets here have no Cache-Control/ETag (only
+            // Last-Modified), so a heuristically-cached stale response can
+            // silently win even on a CACHE_NAME bump. { cache: 'reload' }
+            // forces a real network round-trip so precache always reflects
+            // what the server currently serves.
+            Promise.all(
+                PRECACHE_URLS.map((url) =>
+                    fetch(url, { cache: 'reload' }).then((response) => cache.put(url, response))
+                )
+            )
+        )
     );
     self.skipWaiting();
 });