ISR (revalidate = 30s)

Pass: renderedAt stays the same for 30s. The first reload after that still shows the old value, and the next reload shows a new one. After the first regeneration, platform should show the server (win32/…).

On-demand: POST /api/revalidate?path=/isr with header x-revalidate-secret should make the next visit show a new renderedAt right away.