Reload the browser on template and static changes in dev

Adds django-browser-reload: runserver already restarts on Python changes, but
the browser had to be refreshed by hand for every template or CSS edit. It also
watches static/, so a Tailwind rebuild now refreshes the page on its own.

Mounted only under DEBUG -- it injects a script into every HTML response and
serves an open event stream, neither of which belongs in production; a test
holds that line. Its endpoint is exempt from RequireMFAMiddleware, otherwise a
not-yet-enrolled staff user has the stream redirected away and live reload dies
on the MFA enrolment page, which is exactly a page we are restyling.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

rosterchief/settings.py

@@ -81,6 +81,13 @@ MIDDLEWARE = [
     "django.middleware.clickjacking.XFrameOptionsMiddleware",
 ]
 
+# Reload the browser when templates, static files or Python change. Dev only: it
+# injects a script tag into every HTML response and serves an open event stream,
+# neither of which belongs in production.
+if DEBUG:
+    INSTALLED_APPS += ["django_browser_reload"]
+    MIDDLEWARE += ["django_browser_reload.middleware.BrowserReloadMiddleware"]
+
 AUTHENTICATION_BACKENDS = [
     "django.contrib.auth.backends.ModelBackend",
     "allauth.account.auth_backends.AuthenticationBackend",

rosterchief/tests.py

@@ -0,0 +1,30 @@
+import importlib
+
+from django.test import SimpleTestCase, override_settings
+from django.urls import Resolver404, clear_url_caches, resolve
+
+from . import urls
+
+
+class BrowserReloadUrlTests(SimpleTestCase):
+    """django-browser-reload serves an open event stream and injects a script into
+    every HTML response, so it must never be mounted outside DEBUG."""
+
+    def reload_urlconf(self):
+        importlib.reload(urls)
+        clear_url_caches()
+
+    def tearDown(self):
+        self.reload_urlconf()  # restore the real (DEBUG=False) urlconf
+
+    def test_the_reload_endpoint_is_mounted_in_debug(self):
+        with override_settings(DEBUG=True):
+            self.reload_urlconf()
+
+            self.assertEqual(resolve("/__reload__/events/").view_name, "django_browser_reload:events")
+
+    def test_the_reload_endpoint_is_absent_without_debug(self):
+        self.reload_urlconf()
+
+        with self.assertRaises(Resolver404):
+            resolve("/__reload__/events/")

rosterchief/urls.py

@@ -7,6 +7,7 @@ second factors. ``RequireMFAMiddleware`` then blocks any staff user who has not
 enrolled.
 """
 
+from django.conf import settings
 from django.contrib import admin
 from django.urls import include, path
 from django.views.generic import RedirectView
@@ -17,3 +18,6 @@ urlpatterns = [
     path("accounts/", include("allauth.urls")),
     path("controlpanel/", include("controlpanel.urls")),
 ]
+
+if settings.DEBUG:
+    urlpatterns += [path("__reload__/", include("django_browser_reload.urls"))]