m4: PWA install — manifest, icons, service worker

Make ThoughtSync installable ("Add to Home Screen") without going
offline-first (the Android app is the real offline client, M5):

- web app manifest (name, icons incl. maskable + SVG, standalone, theme)
- generated PNG icon set + apple-touch-icon + favicon, from committed
  SVG sources (a linked-thoughts constellation on the brand tile)
- minimal service worker: installable shell only — caches just an
  offline fallback page, never the app shell / hashed assets / API, so
  data stays fresh and deploys never serve a stale shell
- register the SW in main.ts (progressive enhancement; failures ignored)
- index.html: manifest/icon links, apple-mobile meta, description
- backend: register the .webmanifest MIME type so it serves as
  application/manifest+json
- README: note that install needs a secure context (HTTPS/localhost)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

frontend/public/sw.js

@@ -0,0 +1,36 @@
+// ThoughtSync service worker — installable shell, deliberately NOT offline-first.
+//
+// This exists so the web app satisfies the PWA install criteria ("Add to Home
+// Screen") and shows a friendly page when a navigation happens with no network.
+// The real offline client is the future Android app (M5); to stay always-fresh
+// and avoid deploy staleness, this SW does NOT cache the app shell, hashed build
+// assets, or any /api response — everything but the offline fallback goes
+// straight to the network.
+const CACHE = "thoughtsync-shell-v1";
+const OFFLINE_URL = "/offline.html";
+
+self.addEventListener("install", (event) => {
+  event.waitUntil(
+    caches
+      .open(CACHE)
+      .then((cache) => cache.add(OFFLINE_URL))
+      .then(() => self.skipWaiting()),
+  );
+});
+
+self.addEventListener("activate", (event) => {
+  event.waitUntil(
+    caches
+      .keys()
+      .then((keys) => Promise.all(keys.filter((k) => k !== CACHE).map((k) => caches.delete(k))))
+      .then(() => self.clients.claim()),
+  );
+});
+
+// Only intercept page navigations: try the network, fall back to the cached
+// offline page when the server is unreachable. All other requests (hashed
+// assets, /api/*) are left untouched and hit the network normally.
+self.addEventListener("fetch", (event) => {
+  if (event.request.mode !== "navigate") return;
+  event.respondWith(fetch(event.request).catch(() => caches.match(OFFLINE_URL)));
+});