fix(hosts): add HX-Request to Vary rather than replacing it; the session adds Cookie (#5294)

CI 8616: the integration test asserted Vary == 'HX-Request', but the session
layer appends 'Cookie'. resp.vary.add keeps both; the test asserts membership.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/hosts/routes.py

@@ -100,7 +100,7 @@ async def _list_page(add: dict | None = None):
         and not request.headers.get("HX-History-Restore-Request")
     resp = await make_response(await render_template(
         "hosts/_table.html" if partial else "hosts/list.html", **ctx))
-    resp.headers["Vary"] = "HX-Request"
+    resp.vary.add("HX-Request")
     return resp
 
 

tests/integration/test_hosts_list.py

@@ -55,7 +55,7 @@ def test_the_hosts_list_filters_by_search_group_and_status(app):
         swap = {"HX-Request": "true", "HX-Target": "hosts-table"}
         resp = await client.get("/hosts/", query_string={"q": tag, "group": f"Swarm {tag}"}, headers=swap)
         table = await resp.get_data(as_text=True)
-        assert resp.headers["Vary"] == "HX-Request"
+        assert "HX-Request" in resp.headers["Vary"]
         assert 'class="filter-bar"' not in table and "<html" not in table
         assert f"swarm-{tag}" in table and f"lone-{tag}" not in table