feat(offline): app-shell precache service worker (vite-plugin-pwa)

Migrate the former install-only public/sw.js to a custom (injectManifest)
service worker built from ui/src/sw.ts by vite-plugin-pwa. It precaches the
app shell + hashed assets (Workbox) so an installed web PWA cold-launches with
no network, and falls in-scope navigations back to the precached shell (the
hash router resolves the route client-side). This is the C1 prerequisite for a
usable offline mode: without it a cold offline launch cannot load the bundle.

- ui/src/sw.ts: skipWaiting + clientsClaim + cleanupOutdatedCaches +
  precacheAndRoute(__WB_MANIFEST) + a NavigationRoute fallback to index.html,
  deny-listing the RPC path and /_gm. The Connect stream and API POSTs are
  never precached nor intercepted.
- vite.config.ts: VitePWA(injectManifest); manifest:false (we ship our own),
  injectRegister:false (registration stays manual + web-only in pwa.svelte.ts),
  disabled in the mock build (Playwright unperturbed); landing + polyfills
  excluded from the precache.
- Removed public/sw.js; the registration path (dist/sw.js at /app/) is unchanged.
- New dev deps: vite-plugin-pwa + workbox-{core,precaching,routing}.

Docs: ARCHITECTURE + gateway/README. Offline cold-launch is contour-verified
(the mock e2e harness disables the SW).

ui/src/lib/pwa.svelte.ts

@@ -76,9 +76,11 @@ export async function promptInstall(): Promise<void> {
 }
 
 /**
- * registerServiceWorker registers the install-only worker (ui/public/sw.js). Web-only: skipped in
- * the mock build (a real worker would perturb the Playwright run) and inside a Telegram/VK Mini
- * App. Best-effort — a failed registration only means the app is not installable.
+ * registerServiceWorker registers the app-shell service worker (built from ui/src/sw.ts to
+ * dist/sw.js by vite-plugin-pwa): it satisfies Chromium's installability requirement and precaches
+ * the shell + assets so an installed PWA cold-launches offline. Web-only: skipped in the mock build
+ * (a real worker would perturb the Playwright run) and inside a Telegram/VK Mini App. Best-effort —
+ * a failed registration only means the app is not installable and cannot launch offline.
  */
 export function registerServiceWorker(): void {
   if (typeof navigator === 'undefined' || !('serviceWorker' in navigator)) return;