feat(ui): installable offline PWA — service worker, manifest, icons (F5)

Native SvelteKit service worker (src/service-worker.ts): a version-keyed
cache precaches the app shell + build artefacts (incl. core.wasm) +
static files; activate purges old caches; the gateway is never
intercepted; navigations fall back to the cached shell offline. Adds
static/manifest.webmanifest, a generated placeholder icon set
(scripts/gen-pwa-icons.mjs — dependency-free pure-Node PNG encoder), and
manifest / theme-color / apple-touch tags in app.html.

Gated by Playwright against a production preview (playwright.pwa.config.ts
+ tests/pwa/pwa.spec.ts via `pnpm test:pwa`, wired into ui-test):
manifest + installable icons, SW registration + a single version-keyed
cache, and offline shell load. Lighthouse is not used — its PWA category
was removed in v12.

Docs: ui/docs/pwa-strategy.md (+ index); F5 marked done.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

ui/frontend/playwright.pwa.config.ts

@@ -0,0 +1,31 @@
+import { defineConfig, devices } from "@playwright/test";
+import { FIXTURE_PUBLIC_KEY_RAW_BASE64 } from "./tests/e2e/fixtures/gateway-key";
+
+// The service worker only precaches a real production build (the
+// `$service-worker` `build` list is empty under `vite dev`), so the PWA
+// spec runs against `vite preview` of an actual build — a separate config
+// from the dev-server e2e suite. Chromium only: service-worker + Cache
+// Storage + offline emulation are the surface under test, and WebKit's
+// SW support in headless CI is unreliable.
+export default defineConfig({
+	testDir: "tests/pwa",
+	fullyParallel: false,
+	workers: 1,
+	forbidOnly: !!process.env.CI,
+	retries: process.env.CI ? 2 : 0,
+	reporter: [["list"]],
+	use: {
+		baseURL: "http://localhost:4173",
+		trace: "retain-on-failure",
+	},
+	projects: [{ name: "chromium", use: { ...devices["Desktop Chrome"] } }],
+	webServer: {
+		command: "pnpm build && pnpm preview --port 4173",
+		url: "http://localhost:4173",
+		reuseExistingServer: !process.env.CI,
+		timeout: 180_000,
+		env: {
+			VITE_GATEWAY_RESPONSE_PUBLIC_KEY: FIXTURE_PUBLIC_KEY_RAW_BASE64,
+		},
+	},
+});