fix(hosts): add HX-Request to Vary rather than replacing it; the session adds Cookie (#5294)

CI 8616: the integration test asserted Vary == 'HX-Request', but the session
layer appends 'Cookie'. resp.vary.add keeps both; the test asserts membership.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/hosts/routes.py

@@ -100,7 +100,7 @@ async def _list_page(add: dict | None = None):
         and not request.headers.get("HX-History-Restore-Request")
     resp = await make_response(await render_template(
         "hosts/_table.html" if partial else "hosts/list.html", **ctx))
-    resp.headers["Vary"] = "HX-Request"
+    resp.vary.add("HX-Request")
     return resp