feat(api): Implement API response Cache-Control

- Introduce `withCacheControl` utility function for API responses.
- Apply `private, no-store` to authentication and data modification (POST, PATCH, DELETE) routes.
- Apply `private, no-cache` to sensitive data retrieval (GET) routes.
- Enhance security by preventing caching of private user data.
- Ensure fresh data is always fetched for authenticated API responses.

app/api/projects/[projectId]/videos/route.ts

@@ -5,7 +5,7 @@ import { ProjectMemberRole } from '@prisma/client';
 import { validateUrl, validateOptionalUrl } from '@/lib/validation';
 import { rateLimit } from '@/lib/rate-limit';
 import { notifyProjectOwner } from '@/lib/notifications';
-import { apiErrors, successResponse } from '@/lib/api-response';
+import { apiErrors, successResponse, withCacheControl } from '@/lib/api-response';
 
 type RouteParams = { params: Promise<{ projectId: string }> };
 
@@ -47,7 +47,8 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
             },
         });
 
-        return successResponse({ videos });
+        const response = successResponse({ videos });
+        return withCacheControl(response, 'private, max-age=30, stale-while-revalidate=60');
     } catch (error) {
         console.error('Error fetching videos:', error);
         return apiErrors.internalError('Failed to fetch videos');
@@ -149,7 +150,8 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
             }).catch((err) => console.error('Notification failed:', err));
         }
 
-        return successResponse(video, 201);
+        const response = successResponse(video, 201);
+        return withCacheControl(response, 'private, no-store');
     } catch (error) {
         console.error('Error creating video:', error);
         return apiErrors.internalError('Failed to create video');