HTTP Caching Headers: Cache-Control, ETag, Vary, and the Browser Cache You Don't Understand

Most engineers know HTTP caching exists. Far fewer know what `Cache-Control: max-age=0, must-revalidate` actually means, why ETag and Last-Modified are different, or why their CDN keeps serving stale data after a deploy. The headers aren't complicated -- but the interactions are, and getting them wrong wastes bandwidth, breaks deploys, and serves stale data to angry users.