app: implement /.refresh?key=<secret> for auto-refresh by service hooks.