feat(pwa): installable web app + landing web entry

Make the web SPA an installable PWA and surface it to users:

- manifest.webmanifest + an install-only service worker + 192/512/maskable
  icons (ui/public); PWA head tags in index.html; the .webmanifest MIME type
  registered in the gateway (the distroless image has no /etc/mime.types).
- Platform-adaptive install CTA (components/InstallApp.svelte + lib/pwa):
  one-tap on Chromium, manual Add-to-Home-Screen instructions on iOS Safari,
  hidden elsewhere / once installed / inside a Mini App. Shown under the
  logged-out login card and at the bottom of Settings.
- The landing gains a third entry linking /app/ (the brand tile), with a
  caption under all three (Telegram / VK / Веб-версия).

The service worker is navigation-only (network-first, cached-shell fallback);
hashed assets and the Connect stream are untouched. It exists to satisfy
Chromium's installability requirement and is the single growth point for a
future opt-in offline mode.

Tests: pwa.ts unit tests; a webui probe (manifest/sw.js content-type + the
SPA-fallback-to-HTML trap); e2e for the one-tap CTA, the iOS instructions
modal and the landing web entry. Docs: ARCHITECTURE §13, FUNCTIONAL (+ru),
gateway README.

docs/ARCHITECTURE.md

@@ -1233,7 +1233,14 @@ origin, so the test contour canonicalises to production instead of being indexed
 separate site; the SPA shell is `noindex`, and the landing always boots in Russian (no
 browser-language detection — crawlers render with arbitrary languages). The favicon set,
 `og-image.png` and `robots.txt` ship unhashed from `ui/public/` (generated by
-`assets/icons/`, same tile design as the VK loader). Hash-named `/assets/*` are served
+`assets/icons/`, same tile design as the VK loader). On the web (`/app/`) the SPA is an installable **PWA**:
+`manifest.webmanifest` and an install-only **service worker** (`sw.js`) ship unhashed from
+`ui/public/`, and the client registers the worker **web-only** — never inside a Mini App or the
+mock build. The worker intercepts only top-level navigations (network-first with a cached-shell
+fallback), leaving `/assets/*` and the Connect stream untouched; it exists to satisfy Chromium's
+installability requirement (a registered SW, needed for install on Android) and is the single
+growth point for a future opt-in offline mode. The gateway registers the `.webmanifest` MIME type
+in-process (the distroless image has no `/etc/mime.types`). Hash-named `/assets/*` are served
 `immutable` (a relaunch is a cache hit, not a re-download); the HTML shells are
 `no-cache` so a new deploy is picked up — both containers apply the same caching. An
 in-compose **caddy** is the contour's edge: it owns a single `/_gm` Basic-Auth and