fix(hosts): add HX-Request to Vary rather than replacing it; the session adds Cookie (#5294)

CI 8616: the integration test asserted Vary == 'HX-Request', but the session
layer appends 'Cookie'. resp.vary.add keeps both; the test asserts membership.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/integration/test_hosts_list.py

@@ -55,7 +55,7 @@ def test_the_hosts_list_filters_by_search_group_and_status(app):
         swap = {"HX-Request": "true", "HX-Target": "hosts-table"}
         resp = await client.get("/hosts/", query_string={"q": tag, "group": f"Swarm {tag}"}, headers=swap)
         table = await resp.get_data(as_text=True)
-        assert resp.headers["Vary"] == "HX-Request"
+        assert "HX-Request" in resp.headers["Vary"]
         assert 'class="filter-bar"' not in table and "<html" not in table
         assert f"swarm-{tag}" in table and f"lone-{tag}" not in table