m4: PWA install — manifest, icons, service worker

Make ThoughtSync installable ("Add to Home Screen") without going
offline-first (the Android app is the real offline client, M5):

- web app manifest (name, icons incl. maskable + SVG, standalone, theme)
- generated PNG icon set + apple-touch-icon + favicon, from committed
  SVG sources (a linked-thoughts constellation on the brand tile)
- minimal service worker: installable shell only — caches just an
  offline fallback page, never the app shell / hashed assets / API, so
  data stays fresh and deploys never serve a stale shell
- register the SW in main.ts (progressive enhancement; failures ignored)
- index.html: manifest/icon links, apple-mobile meta, description
- backend: register the .webmanifest MIME type so it serves as
  application/manifest+json
- README: note that install needs a secure context (HTTPS/localhost)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

README.md

@@ -101,6 +101,10 @@ Then open `http://<host>:5000` and register — **the first account becomes the
 - The app waits for the database and runs migrations (`alembic upgrade head`) automatically on start.
 - **Image tags:** `:latest` (stable, built from `main`) · `:dev` (latest `dev` build) ·
   `:<git-sha>` (immutable, for pinning / rollback).
+- **Install as an app (PWA):** ThoughtSync is installable ("Add to Home Screen" / the
+  browser's install button) for an app-like window. Browsers only offer install over a
+  **secure context**, so put the app behind a reverse proxy terminating **HTTPS** (or reach
+  it via `localhost`) — plain `http://<host>:5000` won't show the install prompt.
 
 ## Milestones