Make the app installable as a PWA

Adds a web manifest, icons (standard 192/512, a full-bleed maskable
512 with the glyph kept inside the safe zone, and an iOS touch icon),
theme-color/apple meta tags, and a service worker, so "Install app" /
"Add to Home Screen" gives it its own icon and a standalone window.

The service worker is a deliberate no-cache pass-through: it registers
a fetch listener (so browsers treat the app as installable) but never
calls respondWith(), so every request goes to the network exactly as
without a worker. A caching worker would keep serving an old JS bundle
after each rebuild — the same stale-build confusion that already cost
time on the settings layout fix — and this app is a live view of
authenticated data with no useful offline mode. Registered in
production builds only.

Icons are generated procedurally (server-rack glyph on the sidebar's
dark colour) and encoded as real PNGs; visually checked, including
that the maskable variant keeps the glyph inside the safe zone.

Verified in a real Chromium (headless Edge) over the DevTools protocol
against the built bundle served with the same express.static setup as
production: the DevTools installability audit reported no errors, the
manifest parsed with no errors, the worker registered at scope "/",
activated and took control, and a navigation through the worker
returned the app page normally. The manifest is served as
application/manifest+json and sw.js as JavaScript. The in-app preview
pane silently blocks service-worker script fetches, so it could not
be used for this — hence the real browser. Real dev database mtime
untouched throughout.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -135,6 +135,12 @@ real API response (fixed to derive them from `connectedToControl` and
 `enabledRoutes`). See the git log for the full verification notes per
 integration.
 
+The app is installable as a PWA — "Install app" / "Add to Home Screen" from the
+browser gives it its own icon and a standalone window on phone or desktop. This
+needs the site to be served over HTTPS (browsers only offer install on secure
+origins; `localhost` also counts). The bundled service worker deliberately
+caches nothing, so an installed copy always shows the current build.
+
 ## Requirements
 
 - Node.js 20+